Endpoint Security
,
Internet of Things Security
Web-Based Client on Local Host Didn’t Sanitize Inputs
Video camera surveillance management software made by South Korean manufacturer Idis is susceptible to a one-click attack giving hackers the power to execute arbitrary code, warn security researchers.
See Also: IoT and Cloud Systems Face Escalating Cyber Risks Amid Global Instability
Claroty’s research team uncovered a critical flaw in a web-based client Idis customers use to manage camera deployments and view live feeds.
The flaw, tracked as CVE-2025-12556, with a high CVSS score, depends on a user clicking a link to a page containing malicious JavaScript. Researchers determined that the Idis Chromium-based client directly passed arguments to Chromium Embedded Framework library, creating an opening for an injection attack.
Unlike most JavaScript-based attacks, “this vulnerability allows an attacker to escalate beyond the browser sandbox and achieve code execution on the host itself, introducing a significant security risk,” researchers wrote.
They disclosed their findings to Idis, which in November published a patch in the form of a version upgrade. The U.S. Cybersecurity and Infrastructure Security Agency published an advisory relaying Idis’s advice that customers either upgrade or uninstall the client.
The vulnerability is a side effect of the new era of IP-based video surveillance, Claroty researchers wrote. “What was once a world of on-premises network video recorders (NVRs), local storage arrays and LAN-based management systems is now a connected environment largely operating in the cloud.”
Cloud connectivity means web-based user interfaces – and when those dashboards require local hosts, there’s complexity that introduces risk.
Researchers found that the dashboard, ICM Viewer, listens for the cloud URL and authentication token on localhost:16140. Because the viewer is a Chromium-based application, it accepts Chromium command-line flags, “a powerful mechanism for altering browser behavior at runtime, allowing developers to tailor functionality without modifying the Chromium application,” researchers wrote. “While most flags are benign, a subset can be abused to enable code execution.”
A malicious script sending a debugging flag to an unpatched ICM Viewer launcher through the correctly local host port does, in fact, go directly to the Chromium Embedded Framework for execution, researchers found.
Clicking on strange links is a well-known cybersecurity no-no, but users are frequently social engineered by hackers through spear-phishing and other methods into doing so. The result is that “an attacker would be in control of the host machine and have the ability to execute code, or use that machine as a jumping off point for lateral movement to compromise other endpoints on the network, including other surveillance cameras.”
With reporting by Information Security Media Group’s David Perera in Northern Virginia.