CVE-2026-5386: KMW CCTV Security Cameras Unverified Password Change

Synopsis

An unverified password change flaw in KMW KM-IP521 and KM-IP421 CCTV cameras lets a remote attacker reset the administrator password to a known value without supplying any credentials. The bug is reachable over the network with no authentication, no user interaction, and low attack complexity, after which the attacker has full administrative control of the camera feeds and configuration. No fix is published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the camera's management interface over the network (AV:N).

• AuthenticationNot required

  No credentials are needed; the password reset endpoint accepts unauthenticated requests (PR:N).

• Victim interactionNot required

  No administrator or user action is required for the reset to succeed (UI:N).

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable with no environmental preconditions (AC:L).

Blast Radius

• Resets the administrator password to an attacker-chosen value and grants full admin login to the camera.
• Reads live and stored video feeds, exposing whatever the camera is pointed at.
• Modifies camera configuration, including network settings, recording behavior, and access controls, enabling persistent takeover or pivot into the surrounding network.