Vilar VS-IPC1002 IP cameras contain reflected XSS and local DoS vulnerabilities
Vilar VS-IPC1002 IP cameras contain reflected XSS and local DoS vulnerabilities; vendor unresponsive, patch status unknown.
CERT Polska disclosed two vulnerabilities affecting Vilar VS-IPC1002 IP cameras running firmware version 1.1.0.18, though other versions may also be affected. CVE-2025-53701 is a reflected cross-site scripting vulnerability in the /cgi-bin/action endpoint due to improper input sanitization of GET request parameters, allowing attackers to target authenticated administrators. CVE-2025-53702 is an unauthenticated denial-of-service vulnerability accessible to attackers on the same local network, which can render the camera completely unresponsive through crafted requests to the same endpoint, requiring manual reboot for recovery.
The vulnerabilities were responsibly disclosed by researcher Szymon Paszun through CERT Polska's coordinated vulnerability disclosure process. The vendor, Vilar, did not respond to disclosure attempts, leaving the vulnerabilities unpatched. Organizations deploying these cameras should implement network segmentation to limit exposure, restrict administrative access, and monitor for exploitation attempts until patches become available.
Mentioned in this report
Detection guidance
Reflected XSS Attempt Against Vilar Camera /cgi-bin/action Endpoint
Detects GET requests to the /cgi-bin/action endpoint containing script/HTML injection markers indicative of reflected XSS exploitation (CVE-2025-53701). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Attempt Against Vilar Camera /cgi-bin/action Endpoint
id: abd7ed26-25ce-5a2a-80f6-83f871c43980
status: experimental
description: Detects HTTP GET requests to the /cgi-bin/action endpoint on Vilar VS-IPC1002
cameras containing script tags or JavaScript URI schemes in query parameters, consistent
with reflected XSS exploitation of CVE-2025-53701.
references:
- CERT Polska advisory - Vilar VS-IPC1002 vulnerabilities
author: Vorant
tags:
- attack.T1189
- attack.initial-access
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /cgi-bin/action
xss_markers:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
- alert(
condition: selection and xss_markers
falsepositives:
- Vulnerability scanning or authorized penetration testing against camera web interfaces
- Security researchers validating the disclosed CVE
level: high
Potential DoS Exploitation Attempt Against Vilar Camera /cgi-bin/action Endpoint
Detects crafted requests to the /cgi-bin/action endpoint containing malformed or oversized parameters consistent with the unauthenticated DoS vulnerability CVE-2025-53702. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential DoS Exploitation Attempt Against Vilar Camera /cgi-bin/action Endpoint
id: c369b0af-80ac-543d-81bc-4e12cf5c1644
status: experimental
description: Detects single HTTP requests to /cgi-bin/action with abnormally long
or malformed query strings, which is the pattern used to trigger the unauthenticated
DoS condition (CVE-2025-53702) on Vilar VS-IPC1002 cameras. Repeated occurrences
from the same source in a short window should be treated as higher confidence and
may indicate active exploitation causing device unresponsiveness.
references:
- CERT Polska advisory - Vilar VS-IPC1002 vulnerabilities
author: Vorant
tags:
- attack.T1498
- attack.impact
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /cgi-bin/action
suspicious_query:
cs-uri-query|contains:
- '%00'
- '....'
- \x00
cs-method: GET
condition: selection and suspicious_query
falsepositives:
- Network fuzzing tools or automated vulnerability scanners used by authorized security
teams
- Malformed requests from misconfigured monitoring or proxy devices
level: medium
Unauthenticated Repeated Requests to Camera CGI Action Endpoint from Local Network
Detects unauthenticated HTTP requests to the /cgi-bin/action endpoint originating from local network hosts without prior authentication, a precondition pattern for the DoS exploitation of CVE-2025-53702. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Repeated Requests to Camera CGI Action Endpoint
id: b8d881fc-9ca7-5ca9-a0c0-9bfe9c39a9cf
status: experimental
description: Detects HTTP requests to the /cgi-bin/action endpoint that lack an authentication
cookie/session header, indicating unauthenticated access consistent with exploitation
of the unauthenticated DoS vulnerability in Vilar VS-IPC1002 cameras. Sustained
bursts of such requests from a single source in a short time period should be investigated
as likely DoS attempts causing device unresponsiveness.
references:
- CERT Polska advisory - Vilar VS-IPC1002 vulnerabilities
author: Vorant
tags:
- attack.T1498
- attack.impact
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /cgi-bin/action
filter:
cs-cookie|contains:
- session
- auth
- token
condition: selection and not filter
falsepositives:
- Legitimate camera clients or mobile apps that authenticate via headers not matched
by the filter (e.g., basic auth without cookies)
- Health-check or monitoring systems polling the endpoint without session cookies
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-53701
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free