Vulnerability · Published Oct 23, 2025 · Assigned by CERT-PL
CVE-2025-53701XSS vulnerability in Vilar VS-IPC1002 IP cameras
Medium 4.8
In plain English
A medium-severity cross-site scripting in VS-IPC1002 from Vilar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS (Cross-site Scripting) attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users. The vendor did not respond in any way. Only version 1.1.0.18 was tested, other versions might be vulnerable as well.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Vilar | VS-IPC1002 | 1.1.0.18 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N