CVE-2026-81321

CriticalCVSS 9.8/10Last modified Sep 19, 2026

Description

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Sep 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-813222.1Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error t CVE-2026-813266.8QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's clie CVE-2026-81337.3A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknown functionality of t CVE-2026-813306.5The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits c CVE-2026-813346.1darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array i CVE-2026-813357.5Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name vie CVE-2026-813384.6The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content CVE-2026-813394.3The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz att CVE-2026-81347.2Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when savin CVE-2026-813403.8The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updatin CVE-2026-813416.5wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS CVE-2026-813424.7The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registratio