Input Validation Issue in H.View IP Cameras
CVE-2026-55975

8.6HIGH

Key Information:

Vendor

H.view

Status
Hv-500s6 Ip Camera
Vendor
CVE Published:
26 June 2026

What is CVE-2026-55975?

A security flaw in H.View IP cameras permits authenticated users to input unsanitized XML data into the device's certificate generation interface. This unvalidated input is directly utilized in a backend command for certificate creation, potentially facilitating unauthorized command execution with elevated privileges during this process. Proper input validation measures are essential to mitigate these security risks.

Affected Version(s)

HV-500S6 IP Camera IPCAM_V4.06.88.251229

References

https://hviewsmart.com/pages/contact-us
https://www.cisa.gov/news-events/ics-advisories/icsa-26-1...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fukuhara Rikuto of Smooth Inc. (CTO) and Hosei University reported this vulnerability to CISA.
.