VORANT. Threat Intelligence Sign in Get the full feed

Brickcom cameras expose live feeds via auth flaws

critical vulnerability financial-serviceshealthcaremanufacturing

Brickcom security cameras (v3.2.3.5.6) contain authentication bypass and default credential vulnerabilities allowing remote attackers to access live video feeds and gain administrative control.

CISA has disclosed two critical vulnerabilities affecting multiple Brickcom camera models (Cube, Dome, Bullet, and Box) running firmware version 3.2.3.5.6. CVE-2026-50245 allows unauthenticated access to live snapshot images through the /ONVIF endpoint, while CVE-2026-50005 involves hardcoded default credentials that enable silent access to camera feeds. Both vulnerabilities require no authentication and can be exploited remotely, posing significant privacy and security risks to affected facilities.

The vulnerable devices are deployed worldwide across critical infrastructure sectors including commercial facilities, critical manufacturing, financial services, and healthcare. Brickcom, headquartered in Taiwan, did not respond to CISA's coordination attempts. CISA discovered proof-of-concept exploits authored by researcher parsa rezaie khiabanloo.

No vendor patches are currently available. CISA recommends isolating affected cameras from internet access, placing them behind firewalls, and using VPNs for remote access. Organizations should contact Brickcom directly for support and consider replacing affected devices if patches are not forthcoming.

Mentioned in this report

Vulnerabilities CVE-2026-50005CVE-2026-50245

Detection guidance

Unauthenticated Access to ONVIF Device/Snapshot Endpoint on IoT Camera

ATT&CK T1212

Detects unauthenticated HTTP requests to /onvif device or snapshot endpoints, consistent with exploitation of CVE-2026-50245 to pull live camera feeds without credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthenticated ONVIF Endpoint Access Attempt
id: 791b116f-b5be-5480-816b-c39b8b7045fb
status: experimental
description: Detects HTTP requests to /onvif device_service or snapshot endpoints
  on camera/IoT devices where no valid authentication is present, matching exploitation
  of unauthenticated ONVIF access vulnerabilities (e.g., CVE-2026-50245) that expose
  live camera feeds.
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-uri-stem|contains:
    - /onvif/
    - /onvif/device_service
    - /onvif/snapshot
  auth_present:
    cs-uri-stem|contains: Authorization
  filter:
    src_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter and not auth_present
fields:
- src_ip
- dst_ip
- cs-uri-stem
- sc-status
falsepositives:
- Legitimate VMS/NVR polling ONVIF endpoints from internal management network without
  configured filtering
- Network scanners or vulnerability assessment tools probing camera endpoints as part
  of authorized testing
level: medium
tags:
- attack.T1212
- attack.credential_access
author: Vorant

Successful Authentication to IoT Camera Web Interface Using Default Vendor Account

ATT&CK T1078.001

Detects successful HTTP authentication to camera/IoT device management interfaces using well-known default vendor account names, indicating exploitation of hardcoded default credential vulnerabilities like CVE-2026-50005. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Default Vendor Account Login to Camera Admin Interface
id: 294bda28-eece-5fdf-bee0-1461d36c41f7
status: experimental
description: Detects successful authentication events on camera or NVR web management
  interfaces where the account used matches a well-known vendor default account name
  (e.g. admin), especially from external or unexpected source addresses, consistent
  with abuse of hardcoded default credentials as seen in CVE-2026-50005.
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-uri-stem|contains:
    - /login
    - /cgi-bin/login
    - /setup
    sc-status: 200
  default_account:
    c-username:
    - admin
    - root
    - user
    - guest
  filter:
    src_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and default_account and not filter
fields:
- src_ip
- dst_ip
- c-username
- cs-uri-stem
- sc-status
falsepositives:
- Initial device provisioning or configuration by IT staff using default credentials
  before hardening
- Internal asset discovery/inventory tools authenticating with known default accounts
  for compliance scanning
level: medium
tags:
- attack.T1078.001
- attack.persistence
- attack.initial_access
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-03

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free