# Kenik cameras contain an unauthenticated path traversal vulnerability (CVE-2026-7766)…

Published: 2026-05-25 · Severity: high
Canonical: https://vorant.io/reports/ffa1dfe0-b716-4521-b032-79e3f2ed62c7/kenik-cameras-contain-an-unauthenticated-path-traversal-vulnerability-cve-2026

> Kenik cameras contain an unauthenticated path traversal vulnerability (CVE-2026-7766) allowing arbitrary file read; patches released April 2025-2026.

CERT Polska coordinated disclosure of CVE-2026-7766, a path traversal vulnerability affecting Kenik camera management panels. An unauthenticated attacker can exploit this flaw by sending a crafted GET request with an arbitrary file path to read files on the server without authentication. This vulnerability poses significant risk to organizations deploying affected Kenik cameras, as it enables reconnaissance and potential credential harvesting.

The vendor has released patches addressing the vulnerability. KG-5260xxxx-IL-(G)2 camera models received fixes in version 2026-04-23, while other affected products were patched in version 2025-04-21. The vulnerability was responsibly disclosed by Łukasz Bawolski of Exea Data Center and coordinated through CERT Polska's vulnerability disclosure program.

Organizations using Kenik cameras should prioritize upgrading to patched firmware versions. Until remediation, exposed camera management interfaces should be restricted to trusted networks only, as the vulnerability requires no authentication to exploit.

## Mentioned in this report

- Vulnerabilities: CVE-2026-7766

## Detection guidance (public sample)

### Path Traversal Sequence in HTTP Request to Camera Management Interface

ATT&CK: T1190

Detects HTTP GET requests containing directory traversal sequences (../ or URL-encoded variants) that may indicate exploitation of CVE-2026-7766 against Kenik camera panels. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Path Traversal Sequence in HTTP Request to Camera Management Interface
id: 9b8f6d0b-813e-5b34-8edf-d4c96843a077
status: experimental
description: 'Detects unauthenticated HTTP GET requests containing path traversal
  sequences (../, ..%2f, %2e%2e%2f, or double-encoded variants) targeting web management
  interfaces, consistent with exploitation of CVE-2026-7766 affecting Kenik camera
  panels. The vulnerability allows arbitrary file read without authentication.

  '
references:
- CVE-2026-7766
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: GET
  traversal:
  - cs-uri-query|contains:
    - ../
    - ..\\
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%2f
    - '%252e%252e%252f'
  - cs-uri-stem|contains:
    - ../
    - ..\\
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%2f
    - '%252e%252e%252f'
  condition: selection and 1 of traversal
falsepositives:
- Legitimate security scanners or vulnerability assessment tools testing for path
  traversal
- Web application penetration testing conducted with authorization
level: high
tags:
- attack.t1190
- attack.initial-access
- cve.2026-7766
author: Vorant
```

### HTTP Request for Sensitive System Files via Web Management Interface

ATT&CK: T1083

Detects HTTP requests referencing well-known sensitive configuration or credential files (passwd, shadow, config, ini) potentially retrieved through a path traversal vulnerability such as CVE-2026-7766. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: HTTP Request for Sensitive System Files via Web Management Interface
id: 5eb3dd36-a093-520d-9dde-4019a8b4029c
status: experimental
description: 'Detects HTTP requests that reference well-known sensitive file names
  (e.g. /etc/passwd, shadow, config files, credential stores) commonly targeted for
  reconnaissance and credential harvesting once path traversal access is achieved,
  such as via CVE-2026-7766 in Kenik camera management panels.

  '
references:
- CVE-2026-7766
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: GET
  sensitive_targets:
    cs-uri-query|contains:
    - etc/passwd
    - etc/shadow
    - boot.ini
    - .htpasswd
    - config.xml
    - passwd
    - shadow
    cs-uri-stem|contains:
    - etc/passwd
    - etc/shadow
    - boot.ini
    - .htpasswd
    - config.xml
  condition: selection and sensitive_targets
falsepositives:
- Internal configuration management tools that legitimately reference config.xml paths
- Automated backup or diagnostic utilities reading device configuration files over
  HTTP
level: medium
tags:
- attack.t1083
- attack.discovery
- cve.2026-7766
author: Vorant
```

### Successful Response to Path Traversal Attempt Against Camera Web Panel

ATT&CK: T1190

Detects a 200 OK response following a path-traversal-style GET request, indicating potential successful file disclosure via CVE-2026-7766 against Kenik camera devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Successful Response to Path Traversal Attempt Against Camera Web Panel
id: 9f0ac2a5-5051-5d7b-a639-ed5a5ad99219
status: experimental
description: 'Detects HTTP responses with status code 200 to GET requests containing
  directory traversal sequences, suggesting a successful unauthenticated file read
  via CVE-2026-7766 in Kenik camera management interfaces. Correlate manually across
  a short time window for repeated attempts from the same source as a stronger indicator
  of automated exploitation.

  '
references:
- CVE-2026-7766
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: GET
    sc-status: 200
  traversal:
    cs-uri-query|contains:
    - ../
    - '%2e%2e%2f'
    - ..%2f
    cs-uri-stem|contains:
    - ../
    - '%2e%2e%2f'
    - ..%2f
  condition: selection and 1 of traversal
falsepositives:
- Vulnerability scanners configured to validate path traversal fixes post-patch
- Legitimate file paths that coincidentally include double-dot sequences (rare)
level: high
tags:
- attack.t1190
- attack.initial-access
- cve.2026-7766
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-7766

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ffa1dfe0-b716-4521-b032-79e3f2ed62c7/kenik-cameras-contain-an-unauthenticated-path-traversal-vulnerability-cve-2026.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup