CVE-2025-64770

Missing Authentication for ONVIF in iCam Cameras

State: Published
Severity: 7.0 High
Published: Nov 20, 2025
Updated: Nov 21, 2025
Reserved: Nov 11, 2025

Description

The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may allow an attacker unauthorized access to camera configuration information.

Scores

CVSS	Score	Vector	Source
4.0	7.0 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N	icscert
3.1	6.8 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L	icscert

Weaknesses

CWE-306

Affected Products

Product	Versions
P201iCam365	43.4.0.0 and earlierAffected
QC021iCam365	43.4.0.0 and earlierAffected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-02
https://icam365.net/en/aboutUs/
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-324-02.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.