Kenik cameras allow unauthenticated arbitrary file read
Kenik cameras contain an unauthenticated path traversal vulnerability (CVE-2026-7766) allowing arbitrary file read; patches released April 2025-2026.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-7766, a path traversal vulnerability affecting Kenik camera management panels. An unauthenticated attacker can exploit this flaw by sending a crafted GET request with an arbitrary file path to read files on the server without authentication. This vulnerability poses significant risk to organizations deploying affected Kenik cameras, as it enables reconnaissance and potential credential harvesting.
The vendor has released patches addressing the vulnerability. KG-5260xxxx-IL-(G)2 camera models received fixes in version 2026-04-23, while other affected products were patched in version 2025-04-21. The vulnerability was responsibly disclosed by Łukasz Bawolski of Exea Data Center and coordinated through CERT Polska's vulnerability disclosure program.
Organizations using Kenik cameras should prioritize upgrading to patched firmware versions. Until remediation, exposed camera management interfaces should be restricted to trusted networks only, as the vulnerability requires no authentication to exploit.
Mentioned in this report
Detection guidance
Path Traversal Sequence in HTTP Request to Camera Management Interface
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP GET requests containing directory traversal sequences (../ or URL-encoded variants) that may indicate exploitation of CVE-2026-7766 against Kenik camera panels. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Sequence in HTTP Request to Camera Management Interface
id: 9b8f6d0b-813e-5b34-8edf-d4c96843a077
status: experimental
description: 'Detects unauthenticated HTTP GET requests containing path traversal
sequences (../, ..%2f, %2e%2e%2f, or double-encoded variants) targeting web management
interfaces, consistent with exploitation of CVE-2026-7766 affecting Kenik camera
panels. The vulnerability allows arbitrary file read without authentication.
'
references:
- CVE-2026-7766
logsource:
category: webserver
detection:
selection:
cs-method: GET
traversal:
- cs-uri-query|contains:
- ../
- ..\\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%252e%252e%252f'
- cs-uri-stem|contains:
- ../
- ..\\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%252e%252e%252f'
condition: selection and 1 of traversal
falsepositives:
- Legitimate security scanners or vulnerability assessment tools testing for path
traversal
- Web application penetration testing conducted with authorization
level: high
tags:
- attack.t1190
- attack.initial-access
- cve.2026-7766
author: Vorant
HTTP Request for Sensitive System Files via Web Management Interface
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests referencing well-known sensitive configuration or credential files (passwd, shadow, config, ini) potentially retrieved through a path traversal vulnerability such as CVE-2026-7766. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Request for Sensitive System Files via Web Management Interface
id: 5eb3dd36-a093-520d-9dde-4019a8b4029c
status: experimental
description: 'Detects HTTP requests that reference well-known sensitive file names
(e.g. /etc/passwd, shadow, config files, credential stores) commonly targeted for
reconnaissance and credential harvesting once path traversal access is achieved,
such as via CVE-2026-7766 in Kenik camera management panels.
'
references:
- CVE-2026-7766
logsource:
category: webserver
detection:
selection:
cs-method: GET
sensitive_targets:
cs-uri-query|contains:
- etc/passwd
- etc/shadow
- boot.ini
- .htpasswd
- config.xml
- passwd
- shadow
cs-uri-stem|contains:
- etc/passwd
- etc/shadow
- boot.ini
- .htpasswd
- config.xml
condition: selection and sensitive_targets
falsepositives:
- Internal configuration management tools that legitimately reference config.xml paths
- Automated backup or diagnostic utilities reading device configuration files over
HTTP
level: medium
tags:
- attack.t1083
- attack.discovery
- cve.2026-7766
author: Vorant
Successful Response to Path Traversal Attempt Against Camera Web Panel
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a 200 OK response following a path-traversal-style GET request, indicating potential successful file disclosure via CVE-2026-7766 against Kenik camera devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Successful Response to Path Traversal Attempt Against Camera Web Panel
id: 9f0ac2a5-5051-5d7b-a639-ed5a5ad99219
status: experimental
description: 'Detects HTTP responses with status code 200 to GET requests containing
directory traversal sequences, suggesting a successful unauthenticated file read
via CVE-2026-7766 in Kenik camera management interfaces. Correlate manually across
a short time window for repeated attempts from the same source as a stronger indicator
of automated exploitation.
'
references:
- CVE-2026-7766
logsource:
category: webserver
detection:
selection:
cs-method: GET
sc-status: 200
traversal:
cs-uri-query|contains:
- ../
- '%2e%2e%2f'
- ..%2f
cs-uri-stem|contains:
- ../
- '%2e%2e%2f'
- ..%2f
condition: selection and 1 of traversal
falsepositives:
- Vulnerability scanners configured to validate path traversal fixes post-patch
- Legitimate file paths that coincidentally include double-dot sequences (rare)
level: high
tags:
- attack.t1190
- attack.initial-access
- cve.2026-7766
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-7766
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs