Vilar VS-IPC1002 IP cameras contain reflected XSS and local DoS vulnerabilities
Vilar VS-IPC1002 IP cameras contain reflected XSS and local DoS vulnerabilities; vendor unresponsive, patch status unknown.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed two vulnerabilities affecting Vilar VS-IPC1002 IP cameras running firmware version 1.1.0.18, though other versions may also be affected. CVE-2025-53701 is a reflected cross-site scripting vulnerability in the /cgi-bin/action endpoint due to improper input sanitization of GET request parameters, allowing attackers to target authenticated administrators. CVE-2025-53702 is an unauthenticated denial-of-service vulnerability accessible to attackers on the same local network, which can render the camera completely unresponsive through crafted requests to the same endpoint, requiring manual reboot for recovery.
The vulnerabilities were responsibly disclosed by researcher Szymon Paszun through CERT Polska's coordinated vulnerability disclosure process. The vendor, Vilar, did not respond to disclosure attempts, leaving the vulnerabilities unpatched. Organizations deploying these cameras should implement network segmentation to limit exposure, restrict administrative access, and monitor for exploitation attempts until patches become available.
Mentioned in this report
Detection guidance
Reflected XSS Attempt Against Vilar Camera /cgi-bin/action Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects GET requests to the /cgi-bin/action endpoint containing script/HTML injection markers indicative of reflected XSS exploitation (CVE-2025-53701). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Attempt Against Vilar Camera /cgi-bin/action Endpoint
id: abd7ed26-25ce-5a2a-80f6-83f871c43980
status: experimental
description: Detects HTTP GET requests to the /cgi-bin/action endpoint on Vilar VS-IPC1002
cameras containing script tags or JavaScript URI schemes in query parameters, consistent
with reflected XSS exploitation of CVE-2025-53701.
references:
- CERT Polska advisory - Vilar VS-IPC1002 vulnerabilities
author: Vorant
tags:
- attack.t1189
- attack.initial-access
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /cgi-bin/action
xss_markers:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
- alert(
condition: selection and xss_markers
falsepositives:
- Vulnerability scanning or authorized penetration testing against camera web interfaces
- Security researchers validating the disclosed CVE
level: high
Potential DoS Exploitation Attempt Against Vilar Camera /cgi-bin/action Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects crafted requests to the /cgi-bin/action endpoint containing malformed or oversized parameters consistent with the unauthenticated DoS vulnerability CVE-2025-53702. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential DoS Exploitation Attempt Against Vilar Camera /cgi-bin/action Endpoint
id: c369b0af-80ac-543d-81bc-4e12cf5c1644
status: experimental
description: Detects single HTTP requests to /cgi-bin/action with abnormally long
or malformed query strings, which is the pattern used to trigger the unauthenticated
DoS condition (CVE-2025-53702) on Vilar VS-IPC1002 cameras. Repeated occurrences
from the same source in a short window should be treated as higher confidence and
may indicate active exploitation causing device unresponsiveness.
references:
- CERT Polska advisory - Vilar VS-IPC1002 vulnerabilities
author: Vorant
tags:
- attack.t1498
- attack.impact
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /cgi-bin/action
suspicious_query:
cs-uri-query|contains:
- '%00'
- '....'
- \x00
cs-method: GET
condition: selection and suspicious_query
falsepositives:
- Network fuzzing tools or automated vulnerability scanners used by authorized security
teams
- Malformed requests from misconfigured monitoring or proxy devices
level: medium
Unauthenticated Repeated Requests to Camera CGI Action Endpoint from Local Network
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unauthenticated HTTP requests to the /cgi-bin/action endpoint originating from local network hosts without prior authentication, a precondition pattern for the DoS exploitation of CVE-2025-53702. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Repeated Requests to Camera CGI Action Endpoint
id: b8d881fc-9ca7-5ca9-a0c0-9bfe9c39a9cf
status: experimental
description: Detects HTTP requests to the /cgi-bin/action endpoint that lack an authentication
cookie/session header, indicating unauthenticated access consistent with exploitation
of the unauthenticated DoS vulnerability in Vilar VS-IPC1002 cameras. Sustained
bursts of such requests from a single source in a short time period should be investigated
as likely DoS attempts causing device unresponsiveness.
references:
- CERT Polska advisory - Vilar VS-IPC1002 vulnerabilities
author: Vorant
tags:
- attack.t1498
- attack.impact
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /cgi-bin/action
filter:
cs-cookie|contains:
- session
- auth
- token
condition: selection and not filter
falsepositives:
- Legitimate camera clients or mobile apps that authenticate via headers not matched
by the filter (e.g., basic auth without cookies)
- Health-check or monitoring systems polling the endpoint without session cookies
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-53701
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs