CVE-2025-54810: Cognex In-Sight Information Disclosure

CVE-2025-54810 Overview

CVE-2025-54810 affects Cognex In-Sight Explorer and In-Sight Camera Firmware. The devices expose a proprietary management protocol on TCP port 1069. This protocol handles user management operations, including authentication, without encryption. An adjacent network attacker can passively intercept usernames and passwords transmitted in cleartext. Captured credentials grant access to device management functions, including modification of system properties. The weakness maps to [CWE-294] Authentication Bypass by Capture-replay. CISA tracks the issue in advisory ICSA-25-261-06, which covers industrial control system exposure in manufacturing environments using these vision cameras.

Critical Impact
Adjacent attackers on the same network segment can capture administrative credentials and gain full management control of affected In-Sight cameras.

Affected Products

Cognex In-Sight Explorer
Cognex In-Sight Camera Firmware
Devices exposing the proprietary management service on TCP port 1069

Discovery Timeline

2025-09-18 - CVE-2025-54810 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-54810

Vulnerability Analysis

The In-Sight management service listens on TCP port 1069 and implements a proprietary protocol used by the In-Sight Explorer client. The protocol carries administrative operations such as user creation, password changes, and system property modification. The service transmits authentication data and other sensitive fields over an unencrypted channel. An attacker positioned on the adjacent network can read frames passing between the client and the camera. Captured credentials are reusable because the protocol lacks session binding, nonce exchange, or transport-layer encryption such as Transport Layer Security (TLS).

Root Cause

The root cause is the absence of cryptographic protection on a privileged management channel. The protocol predates modern industrial security requirements and was designed for trusted operational technology (OT) networks. User credentials are serialized and transmitted without TLS, mutual authentication, or challenge-response handshakes. This design choice maps directly to [CWE-294], where captured authentication material can be replayed against the device.

Attack Vector

Exploitation requires adjacent network access, typically through a compromised engineering workstation, a rogue switch port, or a misconfigured VLAN that bridges IT and OT segments. The attacker runs a packet capture tool such as tcpdump or Wireshark filtered on tcp port 1069. When a legitimate operator authenticates from In-Sight Explorer, the credentials traverse the wire in cleartext. The attacker extracts the username and password fields from the captured stream and replays them through the same client or a crafted protocol implementation to assume administrative control.

No verified public proof-of-concept code is available. See the CISA ICS Advisory ICSA-25-261-06 for vendor-supplied technical details.

Detection Methods for CVE-2025-54810

Indicators of Compromise

Unexpected TCP sessions to port 1069 from hosts other than authorized engineering workstations
Successful authentication events on In-Sight devices outside of scheduled maintenance windows
Configuration changes to In-Sight system properties or user accounts without a change ticket
Promiscuous-mode interfaces or unauthorized SPAN sessions on OT switches serving In-Sight cameras

Detection Strategies

Deploy network intrusion detection sensors on OT segments and alert on cleartext credential strings in TCP/1069 payloads
Baseline the set of source IP addresses permitted to communicate with In-Sight cameras and alert on deviations
Correlate In-Sight device audit logs with switch port and Address Resolution Protocol (ARP) table data to identify unauthorized clients

Monitoring Recommendations

Forward switch port mirroring data covering camera VLANs into a network detection platform for protocol inspection
Monitor for ARP spoofing or rogue Dynamic Host Configuration Protocol (DHCP) activity on segments hosting In-Sight devices
Track configuration drift on cameras through periodic exports compared against a known-good baseline

How to Mitigate CVE-2025-54810

Immediate Actions Required

Apply the firmware update referenced in CISA ICS Advisory ICSA-25-261-06 once available from Cognex
Restrict TCP port 1069 access to a dedicated engineering management subnet using firewall or access control list (ACL) rules
Rotate all In-Sight device credentials and avoid reusing passwords shared with other OT assets
Place In-Sight cameras on isolated VLANs with no routing to general corporate networks

Patch Information

Refer to the CISA ICS Advisory ICSA-25-261-06 for vendor-supplied firmware versions and remediation guidance. No fixed version identifier was published in the NVD record at the time of writing.

Workarounds

Tunnel In-Sight Explorer traffic through an IPsec or virtual private network (VPN) overlay to add transport encryption between clients and cameras
Disable unused network ports on switches serving the camera VLAN and enable port security with static MAC bindings
Enforce 802.1X or MAC Authentication Bypass (MAB) on access ports connecting engineering workstations to OT switches
Use a jump host for all In-Sight Explorer sessions and prohibit direct connections from general-purpose endpoints

bash

# Configuration example: restrict TCP/1069 to an engineering management host
# Cisco IOS extended ACL applied inbound on the camera VLAN interface
ip access-list extended INSIGHT-MGMT
  permit tcp host 10.20.30.40 any eq 1069
  deny   tcp any any eq 1069 log
  permit ip any any
!
interface Vlan120
  ip access-group INSIGHT-MGMT in