CVE-2026-38740CWE-319

CVE-2026-38740

Medium · published May 14, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The device transmits sensitive Session Description Protocol (SDP), including ICE credentials and candidates, in cleartext over network interfaces. An attacker with network visibility can intercept these credentials to hijack media streams or authenticate to Foscam's TURN/relay infrastructure to forward arbitrary traffic at the vendor's expense.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00208 · 10.3th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2026-05-14T23:16Z
References (2)
https://github.com/victorGoeman/Foscam-Security-Research/blob/main/CVE-2026-38740.md · [email protected]https://github.com/victorGoeman/Foscam-Security-Research/blob/main/CVE-2026-38740.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 MAY 00:00Z
    Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information
    cvelistv5