Authenticated Command Injection in H.View IP Cameras

Publication date: 2026-06-26

Last updated on: 2026-06-29

Assigner: ICS-CERT

Description

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command execution with elevated privileges during certificate generation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-26

Last Modified

2026-06-29

Generated

2026-07-17

AI Q&A

2026-06-27

EPSS Evaluated

2026-07-15

NVD

CVE-2026-55975

EUVD

EUVD-2026-39926

Affected Vendors & Products

Vendor	Product	Version / Range
h.view	ip_camera	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability exists in H.View IP cameras and involves the device's certificate generation interface. An authenticated user can supply XML fields that are not properly sanitized. These unsanitized inputs are then incorporated into a backend certificate creation command without adequate input validation, which may lead to command execution with elevated privileges during the certificate generation process.

Impact Analysis

The vulnerability can allow an authenticated user to execute commands with elevated privileges on the affected device. This could lead to unauthorized control over the device, potentially compromising its security and functionality.

Hi! I’m here to help you understand CVE-2026-55975. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70