CVE-2026-18192
Received Received - Intake

Arbitrary File Read via Path Traversal in Vacron VIN-DS783E-E6

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: TWCERT/CC

Description
VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-29
Last Modified
2026-07-29
Generated
2026-07-29
AI Q&A
2026-07-29
EPSS Evaluated
N/A
NVD
CVE-2026-18192
EUVD
EUVD-2026-50164

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
feixun_technology vin-ds783e-e6 From 2026-07-29 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18192 is an Arbitrary File Read vulnerability in the VIN-DS783E-E6 IP camera developed by Vacron. It allows authenticated remote attackers to exploit a Relative Path Traversal flaw to download arbitrary system files from the device.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized file access attempts or suspicious activity in logs. Monitor network traffic for authenticated remote connections to the VIN-DS783E-E6 device. Inspect system logs for Relative Path Traversal patterns or unusual file download requests.

Impact Analysis

This vulnerability can allow attackers to access sensitive system files on the device, potentially exposing confidential information. Since it requires authentication, attackers must first gain access to valid credentials or exploit another vulnerability to authenticate.

Mitigation Strategies

Immediately restrict network access to the VIN-DS783E-E6 device to trusted sources only. Contact the vendor Feixun Technology or Vacron for official patches or firmware updates. Ensure all default credentials are changed and strong authentication is enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart