High severity · published Jun 26, 2026
CVE-2026-56414
H.VIEW HV-500S6 IP Camera Unrestricted Upload of File with Dangerous Type
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content to fixed, persistent filesystem locations without validating file type, structure, or size. This design omission enables the placement of unexpected or malformed data in locations intended for trusted certificate material, which could affect system integrity or behavior even after reboot.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HI
HV-500S6 IP Camera · H.VIEW
IPCAM_V4.06.88.251229 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56414
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56414
github.com
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-05.json
hviewsmart.com
https://hviewsmart.com/pages/contact-us
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-05
More from HV-500S6 IP Camera
7.2
CVE-2026-55975
H.VIEW HV-500S6 IP Camera OS Command Injection
