Read the docs
TI-2026-36831 Aliases CVE-2026-50005GHSA-4qgh-qg2j-6vjw

Brickcom Cameras Use of Default Credentials

Priority LOW 37CWE-1392Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera feeds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00197 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BrickcomCube3.2.3.5.6—No fix listedCNA
BrickcomDome3.2.3.5.6—No fix listedCNA
BrickcomBullet3.2.3.5.6—No fix listedCNA
BrickcomBox3.2.3.5.6—No fix listedCNA
  • Cube VendorBrickcom Affected 3.2.3.5.6 Fixed in — No fix listed CNA
  • Dome VendorBrickcom Affected 3.2.3.5.6 Fixed in — No fix listed CNA
  • Bullet VendorBrickcom Affected 3.2.3.5.6 Fixed in — No fix listed CNA
  • Box VendorBrickcom Affected 3.2.3.5.6 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50005
  2. 2026-10-03 Alias added: GHSA-4qgh-qg2j-6vjw

References

Other 3

  • TI-2013-03223 Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom… CVSS 2.0MEDIUM 6.8
  • TI-2026-36994 Brickcom Cameras Missing Authentication for Critical Function CVSS 4.0HIGH 8.3
  • TI-2013-03222 Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other… CVSS 2.0HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences