CVE-2025-9380: FNKvision Y215 CCTV Camera Auth Bypass

CVE-2025-9380 Overview

CVE-2025-9380 is a hard-coded credentials vulnerability in the FNKvision Y215 CCTV Camera firmware version 10.194.120.40. The flaw resides in the /etc/passwd file distributed with the firmware, which contains static credentials that cannot be changed by device operators. An attacker with local access to the device can leverage these embedded credentials to gain privileged control over the camera. The issue is tracked under [CWE-259: Use of Hard-coded Password]. Public technical details describing exploitation have been released, and the vendor did not respond to disclosure attempts.

Critical Impact
Local attackers can authenticate to the affected FNKvision Y215 camera using undocumented hard-coded credentials embedded in firmware binaries, exposing device confidentiality, integrity, and availability.

Affected Products

FNKvision Y215 CCTV Camera
Firmware version 10.194.120.40
Firmware component containing the /etc/passwd file and associated binaries

Discovery Timeline

2025-08-24 - CVE-2025-9380 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9380

Vulnerability Analysis

The FNKvision Y215 firmware ships with hard-coded root credentials embedded in the /etc/passwd file and referenced across multiple binaries on the device. Because the password hash is baked into the firmware image, every deployed camera shares the same authentication material. Once an attacker recovers the credentials from a firmware image or a physically accessible device, that knowledge is transferable to every other Y215 camera in the field.

The vulnerability requires local access, meaning the attacker must reach a console interface, debug port, or logged-in shell context on the device. Exploitation grants complete administrative control of the camera, allowing the attacker to view video streams, modify configuration, disable recording, and pivot deeper into any network segment the device can reach. Independent research published by VoraChat documents the extraction of these credentials from the firmware.

Root Cause

The root cause is an insecure development practice in which the vendor stored static root credentials directly inside the shipped firmware image. The /etc/passwd entry uses a fixed hash that is identical across all units, and no mechanism exists for administrators to rotate the account. This design pattern is classified as [CWE-259: Use of Hard-coded Password].

Attack Vector

An attacker with local access — for example, through UART, a serial console, an exposed local network service, or by extracting the credential from a downloaded firmware image — authenticates as the privileged hard-coded account. No user interaction is required, and only low privileges are needed to initiate the attack. The published proof of concept demonstrates recovery of the hash from the firmware and reuse against a live device. Refer to the VoraChat vulnerability analysis for the exploitation walkthrough.

No verified exploit code is republished here. See the linked research for technical specifics.

Detection Methods for CVE-2025-9380

Indicators of Compromise

Successful root or administrative logins to Y215 cameras from local console, serial, or LAN sources not tied to a known administrator session.
Unexpected outbound connections from the camera to Internet destinations, indicating post-authentication persistence or pivoting.
Changes to camera configuration, firmware, or video retention settings outside of scheduled maintenance windows.

Detection Strategies

Inventory FNKvision Y215 devices and compare running firmware against the affected version 10.194.120.40.
Extract and hash the /etc/passwd file from firmware images to detect the presence of the known hard-coded root entry.
Correlate authentication events from cameras with expected administrator activity to surface unauthorized logins.

Monitoring Recommendations

Log and alert on all authentication events originating from CCTV devices via a centralized SIEM or data lake.
Monitor network traffic from CCTV VLANs for anomalous protocols, outbound connections, or lateral movement attempts.
Track configuration drift on the camera fleet using periodic snapshots and integrity checks.

How to Mitigate CVE-2025-9380

Immediate Actions Required

Isolate FNKvision Y215 cameras on a dedicated network segment with no route to sensitive assets or the Internet.
Restrict physical and console access to affected devices to prevent local exploitation.
Disable any remotely reachable management, Telnet, or SSH services that expose the hard-coded account.
Evaluate replacement of the Y215 fleet with cameras from a vendor that supports credential rotation and issues security updates.

Patch Information

No vendor patch is available. According to the CVE record, the vendor was contacted about this disclosure but did not respond. Because the credentials are embedded in shipped binaries, only a firmware update from FNKvision can fully remediate the issue. Until such an update is released, mitigation depends on network and physical access controls.

Workarounds

Place cameras behind a firewall that blocks inbound access from untrusted networks and limits outbound traffic to a known video management server.
Enforce strict physical security to prevent tampering with device console or debug interfaces.
Use network access control (NAC) and 802.1X to prevent unauthorized devices from reaching the camera management segment.
Continuously monitor camera authentication and network telemetry for signs of compromise; retire devices that show unexplained activity.

bash

# Example: block camera VLAN from initiating outbound Internet traffic
iptables -A FORWARD -i cctv0 -o wan0 -j DROP
iptables -A FORWARD -i wan0 -o cctv0 -m state --state NEW -j DROP