The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated password reset. This flaw allows an attacker to remotely reset the administrator password to a known value without authentication, granting full access to the camera feeds and settings.
KMW recommends connecting surveillance equipment on a separate network, allow only specific devices access to the internet, check for firmware updates regularly, and use cloud connections responsibly.
KMW has issued a firmware update to address this vulnerability. The firmware update can be found at:
https://main.kmw.ro/pub/Firmware/521_421.zip
KM-IP421 - will lose the cloud authorization after this update so users will need to contact customer support to re-authorize the P2P connection.
If there are any issues customers are encouraged to contact KMW directly.