CVE-2026-5386 PUBLISHED

KMW CCTV Security Cameras Unverified Password Change

Assigner: icscert
Reserved: 01.04.2026 Published: 29.05.2026 Updated: 29.05.2026

The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated password reset. This flaw allows an attacker to remotely reset the administrator password to a known value without authentication, granting full access to the camera feeds and settings.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 9.1

Product Status

Vendor KMW
Product KM-IP521
Versions Default: unaffected
  • Version 4.04.91.230307 is affected
Vendor KMW
Product KM-IP421
Versions Default: unaffected
  • Version 4.04.53.210416 is affected

Workarounds

KMW recommends connecting surveillance equipment on a separate network, allow only specific devices access to the internet, check for firmware updates regularly, and use cloud connections responsibly.

Solutions

KMW has issued a firmware update to address this vulnerability. The firmware update can be found at:  https://main.kmw.ro/pub/Firmware/521_421.zip

KM-IP421 - will lose the cloud authorization after this update so users will need to contact customer support to re-authorize the P2P connection.

If there are any issues customers are encouraged to contact KMW directly.

Credits

  • Souvik Kandar reported this vulnerability to CISA. finder

References

Problem Types

  • CWE-620 Unverified Password Change CWE