CVE-2025-13607CWE-306

CVE-2025-13607

Critical · published December 10, 2025

CVSS v3.1
9.4
EPSS
1%
Percentile
55.7
In the wild
Unconfirmed
What it is

🚨 A single vulnerable URL could expose your camera configuration and account credentials—no authentication needed! Think of this vulnerability as a security guard who lets anyone walk through the front door without checking IDs—a huge risk, especially when that door leads straight to sensitive information! This is absolutely devastating; an attacker could effortlessly access your camera settings and sensitive credentials, putting your privacy on the line. Imagine unauthorized eyes peeking into your business—it's a security nightmare waiting to happen!

Put simply

Think of this vulnerability as a security guard who lets anyone walk through the front door without checking IDs—a huge risk, especially when that door leads straight to sensitive information! CVE-2025-13607 allows attackers to retrieve camera configuration information via a vulnerable URL without requiring any authentication. This flaw creates a direct pathway for malicious actors to bypass security measures and access critical data.

What to do

This is absolutely devastating; an attacker could effortlessly access your camera settings and sensitive credentials, putting your privacy on the line. Imagine unauthorized eyes peeking into your business—it's a security nightmare waiting to happen! Patch to the latest version as soon as possible to close this vulnerability. Additionally, review your URL access controls to ensure sensitive endpoints are adequately protected. Implement authentication checks on all sensitive data requests to enhance security. You've got this! With prompt action, you can secure your systems and regain peace of mind. 🛡️

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00785 · 55.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-12-10T23:16Z
References (3)
EPSS history
Timeline
  • 10 DEC 17:15Z
    D-Link CCTV camera model DCS-F5614-L1 Missing Authentication for Critical Function
    cvelistv5