LG Innotek Camera Vulnerability Expose Devices to Admin Hijacking

A critical security vulnerability has been discovered in LG Innotek’s LNV5110R camera model that could allow remote attackers to gain full administrative control of the devices.

The Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on July 24, 2025, warning that the authentication bypass vulnerability affects all versions of the camera model and carries a high CVSS v4 severity score of 8.3.

With the product being end-of-life and no patches available, organizations using these cameras face significant security risks.

The vulnerability, designated as CVE-2025-7742, represents a severe authentication bypass vulnerability that exploits an alternate path or channel within the camera’s firmware.

Security researcher Souvik Kandar, who reported the vulnerability to CISA, discovered that malicious actors can upload HTTP POST requests to the device’s non-volatile storage, potentially leading to remote code execution capabilities.

The technical nature of this vulnerability allows attackers to execute arbitrary commands on targeted devices with administrator-level privileges, effectively compromising the entire system.

The vulnerability has been classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel), highlighting its fundamental impact on the device’s security architecture.

CISA assigned a CVSS v3 base score of 7.0 and an elevated CVSS v4 score of 8.3, reflecting the serious nature of the threat despite its high attack complexity.

The vulnerability’s remote exploitation capability makes it particularly concerning for organizations that have deployed these cameras in critical infrastructure environments.

The advisory specifically notes that the vulnerability can be exploited remotely without requiring user interaction, though the high attack complexity suggests that successful exploitation may require sophisticated techniques.

LG Innotek Camera Vulnerability

LG Innotek has acknowledged the vulnerability but confirmed that the LNV5110R camera model is an end-of-life product that will not receive security patches.

This designation leaves all existing deployments permanently vulnerable to the discovered authentication bypass attack, creating long-term security implications for organizations that continue using these devices.

The company has directed users to visit the LG Security Center for additional guidance, but the absence of a technical fix means that affected organizations must rely entirely on defensive measures and network-level protections.

This situation exemplifies the ongoing challenges organizations face when maintaining legacy security equipment that has reached its support lifecycle.

The global deployment of these cameras, particularly in commercial facilities worldwide, amplifies the potential impact of this vulnerability.

Organizations across multiple sectors may find themselves operating security equipment that cannot be adequately secured through traditional patching mechanisms.

Mitigations

CISA has issued comprehensive mitigation guidance for organizations unable to replace the vulnerable cameras immediately.

The primary recommendation involves minimizing network exposure by ensuring these devices are not accessible from the internet and positioning them behind properly configured firewalls isolated from business networks.

When remote access remains necessary, CISA recommends implementing Virtual Private Networks (VPNs) while acknowledging that VPNs themselves may contain vulnerabilities requiring regular updates.

The agency emphasizes that VPN security depends entirely on the security posture of connected devices.

Additional protective measures include implementing defense-in-depth strategies specifically designed for industrial control systems and conducting thorough impact analyses before deploying defensive measures.

CISA encourages organizations to follow established cybersecurity best practices for proactive ICS asset defense and report any suspected malicious activity through proper channels.

Currently, no known public exploitation targeting this specific vulnerability has been reported to CISA, though the high-severity rating and remote exploitation capability warrant immediate attention from affected organizations.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.