CVE-2026-81640

CVE-2026-81640 is a use of hard-coded credentials (CWE-798) in a Wi-Fi-enabled camera, assigned by CISA's ICS-CERT: an attacker within wireless range can derive the camera's Wi-Fi password and connect to its wireless network. Per the CVSS 4.0 vector, the attack requires only adjacent network access with no privileges, special conditions, or user interaction. Once connected, the attacker defeats the access-point password as a security control and may be able to view the live video stream and reach device services, status interfaces, and firmware-update functionality. Any deployment of the affected camera is exposed, though the vendor, model, and affected version ranges are not named in the available data. There is no evidence of exploitation in the wild, no known public proof-of-concept, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Identify the affected camera vendor and model through the CISA ICS-CERT advisory for CVE-2026-81640 and apply the vendor's firmware update as soon as it is available. Until patched, do not rely on the camera's Wi-Fi access-point password as a security boundary; place the camera on a segmented network segment or wired connection where possible. Monitor the camera's wireless network for unexpected clients and restrict reachability of its status and firmware-update interfaces.