CVE-2026-40624: AVer PTC cameras Files or Directories Accessible to External Parties

Synopsis

An improper input validation vulnerability affects AVer PTC500S, PTC115, PTC500+, and PTC115+ network cameras, reachable over the network without any authentication. A remote attacker can send a specially crafted web request to exploit the flaw. Successful exploitation gives the attacker arbitrary code execution on the affected device. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the camera's web interface over the network; there is no requirement for adjacent-network or physical access.

• AuthenticationNot required

  No account or credential of any privilege level is needed to send the malicious request.

• Victim interactionNot required

  The attacker acts entirely on their own; no user on the target device needs to click a link or take any action.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions, memory-layout dependencies, or other environmental factors required.

Blast Radius

• The attacker gains arbitrary code execution on the camera device, enabling full control of its firmware environment.
• Confidential data stored or processed on the device, such as video streams, credentials, and configuration secrets, is exposed to the attacker.
• The attacker can modify device configuration, disable the camera, or pivot to other network segments reachable from the device.
• Camera availability can be disrupted entirely, taking the device offline or rendering its video feed unusable.