CVE-2026-40624: AVer PTC500S, PTC115, PTC500+ and PTC115+ cameras: unauthenticated remote code execution
CVE-2026-40624 is an improper input validation flaw in AVer PTC500S, PTC115, PTC500+ and PTC115+ cameras. It may let a remote, unauthenticated attacker run arbitrary code through a specially crafted web request, and it carries a critical CVSS 3.1 score of 9.8. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-40624 affects the AVer PTC500S, PTC115, PTC500+ and PTC115+ cameras. According to the CVE record, improper input validation in these devices may allow a remote, unauthenticated attacker to achieve arbitrary code execution through a specially crafted web request. The vulnerability was coordinated by CISA's ICS team (CNA ics-cert@hq.dhs.gov) and is described in CISA advisory ICSA-26-169-01. NVD lists the record as Awaiting Analysis.
Impact
The CNA assigned a CVSS 3.1 base score of 9.8 (critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, plus a CVSS 4.0 score of 9.3. The flaw is reachable over the network, requires no privileges or user interaction, and can lead to full compromise of confidentiality, integrity and availability of the camera. A compromised camera could expose video and audio, be used as a foothold inside the internal network, or be disrupted entirely.
Affected products and versions
- AVer PTC500S
- AVer PTC115
- AVer PTC500+
- AVer PTC115+
The record does not list specific affected firmware versions. Consult the CISA advisory or its CSAF file for version details.
Exploitation status
The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record. Given the unauthenticated network attack vector, the risk should be treated as high for any exposed device.
Remediation and mitigation
- Review the CISA advisory ICSA-26-169-01 for vendor guidance and any available firmware updates; the record itself does not name a fixed version, which does not mean no fix exists.
- Ensure the cameras' web interfaces are not reachable from the internet.
- Place cameras on segmented network zones, behind firewalls, and restrict management access to trusted hosts.
- Where remote access is needed, use secure methods such as an up-to-date VPN.
Detection guidance
- Inventory all AVer PTC-series cameras and confirm their network exposure.
- Monitor web traffic to the cameras for unusual or malformed requests, especially from unexpected sources.
- Watch for unexpected outbound connections, configuration changes or reboots originating from the devices.
Limitations of the available information
- No affected or fixed firmware versions are included in the record.
- The CWE assigned (CWE-552, Files or Directories Accessible to External Parties) does not obviously match the description of improper input validation; the root cause details are therefore unclear.
- NVD has not yet completed its analysis, and no EPSS or SSVC data is available.
Frequently asked questions
Which AVer cameras are affected by CVE-2026-40624?
The PTC500S, PTC115, PTC500+ and PTC115+ models. The record does not specify affected firmware versions.
Is CVE-2026-40624 being exploited?
It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
How severe is it?
The CNA rated it 9.8 (critical) under CVSS 3.1 and 9.3 under CVSS 4.0, since it allows unauthenticated remote code execution over the network.
What should I do now?
Follow CISA advisory ICSA-26-169-01 for vendor updates, remove internet exposure of the cameras and segment them from critical networks.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.