CVE-2025-10538

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

An authentication bypass vulnerability exists in LG Innotek camera models LND7210 and LNV7210R. The vulnerability allows a malicious actor to gain access to camera information including user account information.

Metrics

CVSS 4.0 8.8/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
LG Innotek	Camera Model LND7210	<= 2061.0.0.1608317
LG Innotek	Camera Model LNV7210R	<= 2237.0.0.1505220

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-07

Timeline

Published: Oct 1, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-105394.8Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves i CVE-2025-10546.4The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the UI Coun CVE-2025-105406.5iMonitor EAM 9.6394 transmits communication between the EAM client agent and the EAM server, as well as between the EAM monitor management s CVE-2025-105417.8iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\SYSTEM privileges. This service includes an inse CVE-2025-105429.8iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. CVE-2025-105435.3In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly CVE-2025-105448.6Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing adminis CVE-2025-105454.3Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which CVE-2025-105465.1This vulnerability exist in PPC 2K15X Router, due to improper input validation for the Common Gateway Interface (CGI) parameters at its web CVE-2025-105479.8An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the a CVE-2025-105486.5The CleverControl employee monitoring software (v11.5.1041.6) fails to validate TLS server certificates during the installation process. The CVE-2025-105495.1EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory