Hard-coded credentials in I-O DATA DEVICE, INC. Multiple I-O DATA network camera products
Priority MEDIUM 41CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) use hardcoded credentials which may allow an remote authenticated attacker to execute arbitrary OS commands on the device via unspecified vector.
Why it matters now
EPSS 0.01624 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| I-O DATA DEVICE, INC. | Multiple I-O DATA network camera products | (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) | — | No fix listed | CNA |
- Multiple I-O DATA network camera products VendorI-O DATA DEVICE, INC. Affected (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:iodata:ts-wrlp_firmware:*:*:*:*:*:*:*:* | up to 1.09.04 | Vulnerable | Iodata |
| cpe:2.3:h:iodata:ts-wrlp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Iodata |
| cpe:2.3:o:iodata:ts-wrlp\/e_firmware:*:*:*:*:*:*:*:* | up to 1.09.04 | Vulnerable | Iodata |
| cpe:2.3:h:iodata:ts-wrlp\/e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Iodata |
| cpe:2.3:o:iodata:ts-wrla_firmware:*:*:*:*:*:*:*:* | up to 1.09.04 | Vulnerable | Iodata |
| cpe:2.3:h:iodata:ts-wrla:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Iodata |
- cpe:2.3:o:iodata:ts-wrlp_firmware:*:*:*:*:*:*:*:* Versions up to 1.09.04 Vulnerable ·Iodata
- cpe:2.3:h:iodata:ts-wrlp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Iodata
- cpe:2.3:o:iodata:ts-wrlp\/e_firmware:*:*:*:*:*:*:*:* Versions up to 1.09.04 Vulnerable ·Iodata
- cpe:2.3:h:iodata:ts-wrlp\/e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Iodata
- cpe:2.3:o:iodata:ts-wrla_firmware:*:*:*:*:*:*:*:* Versions up to 1.09.04 Vulnerable ·Iodata
- cpe:2.3:h:iodata:ts-wrla:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Iodata
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-0663
- 2026-10-03 Alias added: GHSA-m444-29mg-hm99
References
More I-O DATA DEVICE, INC. vulnerabilities
- TI-2025-23129 OS command injection in I-O DATA DEVICE, INC. HDL-TC1 CVSS 4.0CRITICAL 9.3
- TI-2016-06558 OS command injection in I-O DATA DEVICE, INC. WFS-SR01 CVSS 3.0CRITICAL 9.8
- TI-2017-01445 Memory corruption in I-O DATA DEVICE, INC. WN-G300R3 CVSS 3.0CRITICAL 9.8
- TI-2024-35228 Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware… CVSS 3.0HIGH 7.5
- TI-2025-35943 OS command injection in I-O DATA DEVICE, INC. WN-7D36QR CVSS 4.0HIGH 8.6
- TI-2017-01418 Memory corruption in I-O DATA DEVICE, INC. TS-WPTCAM CVSS 3.0HIGH 8.8
Sources
- CVE-2018-0663 · CVE Program
- CVE-2018-0663 · NVD
- FIRST EPSS
- GHSA-m444-29mg-hm99 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences