Kenik cameras contain an unauthenticated path traversal vulnerability (CVE-2026-7766)…
Kenik cameras contain an unauthenticated path traversal vulnerability (CVE-2026-7766) allowing arbitrary file read; patches released April 2025-2026.
CERT Polska coordinated disclosure of CVE-2026-7766, a path traversal vulnerability affecting Kenik camera management panels. An unauthenticated attacker can exploit this flaw by sending a crafted GET request with an arbitrary file path to read files on the server without authentication. This vulnerability poses significant risk to organizations deploying affected Kenik cameras, as it enables reconnaissance and potential credential harvesting.
The vendor has released patches addressing the vulnerability. KG-5260xxxx-IL-(G)2 camera models received fixes in version 2026-04-23, while other affected products were patched in version 2025-04-21. The vulnerability was responsibly disclosed by Łukasz Bawolski of Exea Data Center and coordinated through CERT Polska's vulnerability disclosure program.
Organizations using Kenik cameras should prioritize upgrading to patched firmware versions. Until remediation, exposed camera management interfaces should be restricted to trusted networks only, as the vulnerability requires no authentication to exploit.
Mentioned in this report
Detection guidance
Path Traversal Sequence in HTTP Request to Camera Management Interface
Detects HTTP GET requests containing directory traversal sequences (../ or URL-encoded variants) that may indicate exploitation of CVE-2026-7766 against Kenik camera panels. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Sequence in HTTP Request to Camera Management Interface
id: 9b8f6d0b-813e-5b34-8edf-d4c96843a077
status: experimental
description: 'Detects unauthenticated HTTP GET requests containing path traversal
sequences (../, ..%2f, %2e%2e%2f, or double-encoded variants) targeting web management
interfaces, consistent with exploitation of CVE-2026-7766 affecting Kenik camera
panels. The vulnerability allows arbitrary file read without authentication.
'
references:
- CVE-2026-7766
logsource:
category: webserver
product: generic
detection:
selection:
cs-method: GET
traversal:
- cs-uri-query|contains:
- ../
- ..\\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%252e%252e%252f'
- cs-uri-stem|contains:
- ../
- ..\\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%252e%252e%252f'
condition: selection and 1 of traversal
falsepositives:
- Legitimate security scanners or vulnerability assessment tools testing for path
traversal
- Web application penetration testing conducted with authorization
level: high
tags:
- attack.t1190
- attack.initial-access
- cve.2026-7766
author: Vorant
HTTP Request for Sensitive System Files via Web Management Interface
Detects HTTP requests referencing well-known sensitive configuration or credential files (passwd, shadow, config, ini) potentially retrieved through a path traversal vulnerability such as CVE-2026-7766. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Request for Sensitive System Files via Web Management Interface
id: 5eb3dd36-a093-520d-9dde-4019a8b4029c
status: experimental
description: 'Detects HTTP requests that reference well-known sensitive file names
(e.g. /etc/passwd, shadow, config files, credential stores) commonly targeted for
reconnaissance and credential harvesting once path traversal access is achieved,
such as via CVE-2026-7766 in Kenik camera management panels.
'
references:
- CVE-2026-7766
logsource:
category: webserver
product: generic
detection:
selection:
cs-method: GET
sensitive_targets:
cs-uri-query|contains:
- etc/passwd
- etc/shadow
- boot.ini
- .htpasswd
- config.xml
- passwd
- shadow
cs-uri-stem|contains:
- etc/passwd
- etc/shadow
- boot.ini
- .htpasswd
- config.xml
condition: selection and sensitive_targets
falsepositives:
- Internal configuration management tools that legitimately reference config.xml paths
- Automated backup or diagnostic utilities reading device configuration files over
HTTP
level: medium
tags:
- attack.t1083
- attack.discovery
- cve.2026-7766
author: Vorant
Successful Response to Path Traversal Attempt Against Camera Web Panel
Detects a 200 OK response following a path-traversal-style GET request, indicating potential successful file disclosure via CVE-2026-7766 against Kenik camera devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Successful Response to Path Traversal Attempt Against Camera Web Panel
id: 9f0ac2a5-5051-5d7b-a639-ed5a5ad99219
status: experimental
description: 'Detects HTTP responses with status code 200 to GET requests containing
directory traversal sequences, suggesting a successful unauthenticated file read
via CVE-2026-7766 in Kenik camera management interfaces. Correlate manually across
a short time window for repeated attempts from the same source as a stronger indicator
of automated exploitation.
'
references:
- CVE-2026-7766
logsource:
category: webserver
product: generic
detection:
selection:
cs-method: GET
sc-status: 200
traversal:
cs-uri-query|contains:
- ../
- '%2e%2e%2f'
- ..%2f
cs-uri-stem|contains:
- ../
- '%2e%2e%2f'
- ..%2f
condition: selection and 1 of traversal
falsepositives:
- Vulnerability scanners configured to validate path traversal fixes post-patch
- Legitimate file paths that coincidentally include double-dot sequences (rare)
level: high
tags:
- attack.t1190
- attack.initial-access
- cve.2026-7766
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-7766
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free