Vulnerability · Published Sep 18, 2025 · Assigned by icscert
CVE-2025-54497Cognex In-Sight Explorer and In-Sight Camera Firmware Incorrect Permission Assignment for Critical Resource
High 8.1
In plain English
A high-severity incorrect permission assignment in In-Sight 2000 series from Cognex. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and device reboots, which require authentication. A user with protected privileges can successfully invoke the SetSerialPort functionality to modify relevant device properties (such as serial interface settings), contradicting the security model proposed in the user manual.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cognex | In-Sight 2000 series | 5.x – through 6.5.1 |
| Cognex | In-Sight 7000 series | 5.x – through 6.5.1 |
| Cognex | In-Sight 8000 series | 5.x – through 6.5.1 |
| Cognex | In-Sight 9000 series | 5.x – through 6.5.1 |
| Cognex | In-Sight Explorer | 5.x – through 6.5.1 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H