Cognex Says It Won’t Patch Flaws
Nearly a dozen serious vulnerabilities in a Cognex industrial smart camera will go without a patch because the company says the model is “too old to merit a fix.”
See Also: When Identity Protection Fails: Rethinking Resilience for a Modern Threat Landscape
Industrial security firm Nozomi Networks uncovered nine flaws during a security assessment of the Cognex IS2000M-120, a smart camera deployed in manufacturing for part inspection, presence detection and barcode reading. The weaknesses could enable attackers to fully compromise the devices.
The U.S. Cybersecurity and Infrastructure Security Agency published an advisory on Sept. 18. The cameras do not store sensitive data or act as network infrastructure components but their role in automation means exploitation could halt production lines, damage equipment, or compromise safety-critical processes.
CISA and Nozomi each wrote that Cognex would prefer that customers buy a new camera from their line of industrial equipment, opting to not develop a patch. “Despite the fact that the IS2000M-120 remains a commercially available product, the vendor has acknowledged that it is considering an end-of-life status for the device,” Nozomi wrote.
Nozomi’s research focused on the In-Sight Explorer platform, which provides the interface for configuring and managing Cognex smart cameras. The potential risks span three primary attack scenarios.
An unauthenticated attacker on the same network could exploit weaknesses in the In-Sight protocol to intercept and reuse encrypted credentials. The camera has three protocols that require user authentication, but each of them have the same authentication method, based on a username and password combination. Passwords are encrypted before they’re sent to an unencrypted channel, but the same encryption key is repeatedly used across multiple sessions. That allows an attacker to capture the encrypted password and carry out a replay attack – a flaw now tracked as CVE-2025-54810.
Nozomi also found that a low-privileged user could escalate access rights due to insufficient authorization controls, a flaw tracked as CVE-2025-53969.
An attacker with limited access to a Windows engineering workstation running In-Sight Explorer could also tamper with camera backup data, a flaw tracked as CVE-2025-53947. The flaw exists because a backup data folder containing “jobs” for the camera to execute is weakly protected. Were an administrator to restore a device using the backup data, the backup files could contain malicious or disruptive tasks.
Nozomi and CISA advised Cognex cameras to cut off the devices from internet access and shield them behind a firewall and VPN access.