CVE-2026-1241: Pelco Sarix Cameras Auth Bypass Flaw

CVE-2026-1241 Overview

CVE-2026-1241 is an authentication bypass vulnerability affecting Pelco, Inc. Sarix Professional 3 Series Cameras. The vulnerability exists in the web management interface due to inadequate enforcement of access controls, allowing certain functionality to be accessed without proper authentication. This weakness enables unauthorized viewing of live video streams, creating significant privacy concerns and operational risks for organizations deploying these security cameras.

Critical Impact

Unauthorized access to live video surveillance feeds can compromise physical security operations, expose sensitive locations to adversaries, and create serious regulatory and compliance challenges for affected organizations.

Affected Products

• Pelco Sarix Professional 3 Series Cameras
• Web Management Interface components

Discovery Timeline

• February 26, 2026 - CVE-2026-1241 published to NVD
• February 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1241

Vulnerability Analysis

This authentication bypass vulnerability (CWE-288: Authentication Bypass Using an Alternate Path or Channel) affects the web management interface of Pelco Sarix Professional 3 Series Cameras. The root cause stems from inadequate enforcement of access controls within the camera's web interface, allowing attackers to access protected functionality through alternate paths that do not properly verify authentication credentials.

The vulnerability is network-accessible without requiring any user interaction or prior authentication, making it particularly concerning for organizations with internet-exposed camera systems. Successful exploitation results in unauthorized access to confidential video streams while maintaining no impact on system integrity or availability.

Root Cause

The vulnerability originates from CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The web management interface fails to consistently enforce authentication requirements across all endpoints and functionality. This design flaw allows attackers to bypass the intended authentication mechanism by accessing certain camera functions through alternate paths that were not properly secured with authentication checks.

Attack Vector

The attack vector is network-based, requiring no authentication and no user interaction. An attacker with network access to the vulnerable camera's web management interface can exploit this vulnerability remotely.

The exploitation flow involves:

1. The attacker identifies a Pelco Sarix Professional 3 Series Camera on the network
2. The attacker accesses the web management interface and identifies endpoints that bypass authentication
3. By accessing these unprotected paths, the attacker gains unauthorized access to live video streams
4. No credentials or prior access is required to complete the attack

For detailed technical information, refer to the CISA ICS Advisory ICSA-26-057-02.

Detection Methods for CVE-2026-1241

Indicators of Compromise

• Unexpected or unauthorized access attempts to camera web management interfaces from unknown IP addresses
• Abnormal HTTP requests to camera endpoints that bypass normal authentication flows
• Increased network traffic to cameras from internal or external hosts not associated with authorized monitoring systems
• Log entries showing access to video streaming endpoints without corresponding authentication events

Detection Strategies

• Monitor network traffic for HTTP/HTTPS connections to camera management interfaces from unauthorized sources
• Implement network segmentation alerts to detect cross-VLAN access attempts to surveillance camera networks
• Review web server access logs on affected cameras for requests to protected resources without preceding authentication
• Deploy intrusion detection rules to identify authentication bypass attempts against camera web interfaces

Monitoring Recommendations

• Place surveillance cameras on isolated network segments with strict access control policies
• Implement continuous monitoring of camera network segments for anomalous connection attempts
• Configure SIEM rules to alert on direct access to video streaming endpoints without authentication
• Regularly audit access logs for cameras and correlate with authorized user activity

How to Mitigate CVE-2026-1241

Immediate Actions Required

• Isolate affected Pelco Sarix Professional 3 Series Cameras from untrusted network segments immediately
• Implement network access controls to restrict camera management interface access to authorized systems only
• Review camera access logs for signs of unauthorized access or exploitation
• Contact Pelco, Inc. for guidance on available firmware updates or patches
• Consider temporarily disabling remote management access until mitigations are in place

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-26-057-02 for official vendor guidance and patch availability. Contact Pelco, Inc. directly for the latest firmware updates addressing this vulnerability.

Workarounds

• Deploy affected cameras behind a VPN or firewall that requires authentication before network access
• Implement network segmentation to isolate surveillance camera traffic from general network access
• Use firewall rules to restrict access to camera web management interfaces to specific authorized IP addresses only
• Enable logging on network devices to monitor all access attempts to camera systems
• Consider implementing a jump host or bastion server for camera administration