CVE-2019-12289

9.8 criticalEPSS 2.2%

Critical (9.8) in vstracam. EPSS 2.2% chance of exploitation in the next 30 days.

An issue was discovered in upgrade_firmware.cgi on VStarcam 100T (C7824WIP) CH-sys-48.53.75.119~123 and 200V (C38S) CH-sys-48.53.203.119~123 devices. A remote command can be executed through a system firmware update without authentication. The attacker can modify the files within the internal firmware or even steal account information by executing a command.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2019-05-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

vstracam:c38s_firmware
vstracam:c7824wip_firmware

References

http://f1security.co.kr/cve/cve_190314.htm
http://f1security.co.kr/cve/cve_190314.htm

Check your stack JSON