CVE-2026-55975

HighCVSS 7.2/10Last modified Oct 25, 2026

Description

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command execution with elevated privileges during certificate generation.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jun 26, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-559769.1Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CVE-2026-559773.3Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting me CVE-2026-559788.4An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel CVE-2026-559795.2An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. CVE-2026-55987.5Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associat CVE-2026-559805.5A denial-of-service vulnerability in CatchPulse could allow an attacker to conduct a stack buffer overrun attack, leading to a denial-of-ser CVE-2026-559819.6A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upl CVE-2026-559829.1OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes CVE-2026-559842.7Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service CVE-2026-559854.3The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configura CVE-2026-559865.4Email Management API Bypasses ManageCredentials Feature Restrictions CVE-2026-559878.1OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)