Brickcom cameras expose live feeds via auth flaws
Brickcom security cameras (v3.2.3.5.6) contain authentication bypass and default credential vulnerabilities allowing remote attackers to access live video feeds and gain administrative control.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has disclosed two critical vulnerabilities affecting multiple Brickcom camera models (Cube, Dome, Bullet, and Box) running firmware version 3.2.3.5.6. CVE-2026-50245 allows unauthenticated access to live snapshot images through the /ONVIF endpoint, while CVE-2026-50005 involves hardcoded default credentials that enable silent access to camera feeds. Both vulnerabilities require no authentication and can be exploited remotely, posing significant privacy and security risks to affected facilities.
The vulnerable devices are deployed worldwide across critical infrastructure sectors including commercial facilities, critical manufacturing, financial services, and healthcare. Brickcom, headquartered in Taiwan, did not respond to CISA's coordination attempts. CISA discovered proof-of-concept exploits authored by researcher parsa rezaie khiabanloo.
No vendor patches are currently available. CISA recommends isolating affected cameras from internet access, placing them behind firewalls, and using VPNs for remote access. Organizations should contact Brickcom directly for support and consider replacing affected devices if patches are not forthcoming.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-03
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs