« Volver al listado

CVE-2026-7766

Estado: AplazadaAlta (8.3)—

Kenik Camera management Panel is vulnerable to Path Traversal vulnerability. An unauthenticated attacker can send GET request with arbitrary file path and read corresponding files located on the server.

The issue was fixed in version 2026-04-23 of the KG-5260xxxx-IL-(G)2 cameras. Rest of the products were fixed in version 2025-04-21.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:A indica red adyacente sin autenticación. Path Traversal (CWE-22) permite lectura arbitraria de archivos del servidor, mapeando a T1005 (datos del sistema). T1210 por acceso remoto a servicio sin privilegios previos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramPrivileged Account ManagementNetwork SegmentationDisable or Remove Feature or ProgramApplication Isolation and Sandboxing

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Kenik — Camera Management PanelAIKenik — Kg-5260xxxx-il- G 2AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-7766",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-7766",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-26T15:58:49.646754Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cvd@cert.pl",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "ADJACENT",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cvd@cert.pl",
      "affectedData": [
        {
          "vendor": "Kenik",
          "product": "KG-5230TAS-IL-3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2025-04-21",
              "versionType": "date"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Kenik",
          "product": "KG-5230TAS-IL-G3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2025-04-21",
              "versionType": "date"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Kenik",
          "product": "KG-5230DAS-IL-G3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2025-04-21",
              "versionType": "date"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Kenik",
          "product": "KG-5260TZAS-IL-3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2025-04-21",
              "versionType": "date"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Kenik",
          "product": "KG-5260DZAS-IL-3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2025-04-21",
              "versionType": "date"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Kenik",
          "product": "KG-5260TZAS-IL-G3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2025-04-21",
              "versionType": "date"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Kenik",
          "product": "KG-5260DZAS-IL-G3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2025-04-21",
              "versionType": "date"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Kenik",
          "product": "KG-5260xxxx-IL-(G)2",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2026-04-23",
              "versionType": "date"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-05-25T13:16:26.193",
  "references": [
    {
      "url": "https://cert.pl/posts/2026/05/CVE-2026-7766",
      "source": "cvd@cert.pl"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cvd@cert.pl",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kenik Camera management Panel is vulnerable to Path Traversal vulnerability. An unauthenticated attacker can send GET request with arbitrary file path and read corresponding files located on the server.\n\nThe issue was fixed in version 2026-04-23 of the KG-5260xxxx-IL-(G)2 cameras.\nRest of the products were fixed in version 2025-04-21."
    },
    {
      "lang": "es",
      "value": "El Panel de gestión de cámaras Kenik es vulnerable a una vulnerabilidad de salto de ruta. Un atacante no autenticado puede enviar una solicitud GET con una ruta de archivo arbitraria y leer los archivos correspondientes ubicados en el servidor.\n\nEl problema se solucionó en la versión 2026-04-23 de las cámaras KG-5260xxxx-IL-(G)2.\nEl resto de los productos se solucionaron en la versión 2025-04-21."
    }
  ],
  "lastModified": "2026-07-23T11:10:00.120",
  "sourceIdentifier": "cvd@cert.pl"
}