by Kastro
Paper/Archive/CVE-2025-13658

CVE-2025-13658

Industrial Video & Control Longwatch — Industrial Video & Control Longwatch has a Code Injection vulnerability

EPSS 0.7%CVSS 9.3
critical.is priorityof 100
38
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 52.5.525 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signing and execution controls. Exploitation results in SYSTEM-level privileges.

Affected

ProductAffectedFixed inSource
Longwatch6.309 – 6.334–CNA

Scores by source

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-25-336-01