Fukuhara Rikuto

**Name of the Vulnerable Software and Affected Versions** H.View HV-500S6 IP cameras (affected versions not specified) **Description** An authenticated user can supply unsanitized XML fields to the certificate generation interface. These fields are incorporated into a backend certificate creation command without proper input validation, allowing for command execution with elevated privileges. This issue has been exploited in real-world incidents to enable privilege escalation and lateral movement across connected infrastructure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** H.View HV-500S6 IP Camera (affected versions not specified) **Description** Certificate-related upload interfaces allow authenticated users to store arbitrary file content in fixed, persistent filesystem locations. The system fails to validate the file type, structure, or size, allowing the placement of malformed data in locations reserved for trusted certificate material. This can compromise system integrity and affect behavior even after a reboot. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.