CVE-2025-13658
Industrial Video & Control Longwatch has a Code Injection vulnerability
- State
- Published
- Severity
- 9.3 Critical
- Published
- Dec 2, 2025
- Updated
- Dec 2, 2025
- Reserved
- Nov 25, 2025
Description
A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signing and execution controls. Exploitation results in SYSTEM-level privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | icscert |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
LongwatchIndustrial Video & Control |
|
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-336-01government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.