CVE-2025-53701

11th percentile - higher than 11% of all known CVEs

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS because parameters in GET requests sent to the /cgi-bin/action endpoint are not properly sanitized, making it possible to target logged-in admin users. The vendor did not respond in any way; only version 1.1.0.18 was tested, other versions might be vulnerable as well.

An attacker could trick an administrator into clicking a malicious link, allowing script execution in their browser and potential takeover of the camera. The risk applies to Vilar VS-IPC1002 cameras, particularly version 1.1.0.18.

Due to the vendor's lack of response, it is recommended to isolate the cameras in a dedicated VLAN, restrict access to the administrative interface, and consider replacing the devices with supported models.