Industrial Video & Control Longwatch Unauthenticated Remote Code Execution Vulnerability

A code injection vulnerability has been identified in Industrial Video & Control Longwatch devices, specifically in versions 6.309 to 6.334. This vulnerability allows unauthenticated HTTP GET requests to execute arbitrary code through an exposed endpoint. The issue arises from a lack of code signing and execution controls, with exploitation leading to SYSTEM-level privileges.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution with elevated privileges on the affected Longwatch device.

Remediation

Users running Longwatch versions 6.309 to 6.334 should upgrade to version 6.335 or later. For more details, consult the Longwatch Security Bulletin available on the Industrial Video & Control website.