← back
CVE-2025-64770

Missing Authentication for ONVIF in iCam Cameras

CVSS 7 HIGHEPSS 0.2%CWE-306
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
20 Nov 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may allow an attacker unauthorized access to camera configuration information.
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
iCam365 · P201iCam365 · QC021
References
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-324-02.jsonhttps://icam365.net/en/aboutUs/https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-02