CVE-2026-7766: Kenik Camera Path Traversal Vulnerability

CVE-2026-7766 Overview

CVE-2026-7766 is a path traversal vulnerability [CWE-22] affecting the Kenik Camera management Panel. An unauthenticated attacker on an adjacent network can send a crafted GET request containing an arbitrary file path. The server then returns the contents of the requested file, exposing sensitive data stored on the device.

The issue was fixed in firmware version 2026-04-23 for the KG-5260xxxx-IL-(G)2 camera series. All remaining affected products received fixes in version 2025-04-21.

Critical Impact
Unauthenticated adjacent-network attackers can read arbitrary files from affected Kenik cameras, exposing credentials, configuration data, and other sensitive content.

Affected Products

Kenik Camera management Panel — KG-5260xxxx-IL-(G)2 series (fixed in 2026-04-23)
Kenik Camera management Panel — all other affected models (fixed in 2025-04-21)
Devices exposing the management panel on the local network

Discovery Timeline

2026-05-25 - CVE-2026-7766 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-7766

Vulnerability Analysis

The Kenik Camera management Panel fails to validate and sanitize user-supplied file path parameters in HTTP GET requests. The web interface accepts a path value and resolves it against the server filesystem without restricting traversal sequences such as ../. As a result, the server returns file contents from locations outside the intended web root.

The vulnerability requires no authentication. An attacker with adjacent-network access to the camera's management interface can issue a single HTTP request to retrieve target files. Recoverable data may include configuration files, credential stores, and operating system files accessible to the web server process.

Because network camera devices frequently store administrative credentials in plaintext or weakly protected formats, file disclosure on these endpoints often enables follow-on attacks. These include device takeover, lateral movement, and pivoting into the surveillance network.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The application concatenates user input directly into a filesystem path used by the file-serving routine. No canonicalization or allowlist check is performed before the file is read and returned in the HTTP response.

Attack Vector

An unauthenticated attacker connected to the same network segment as the camera issues an HTTP GET request to the management panel. The request includes a file path parameter containing directory traversal sequences referencing a file outside the web root. The server reads the target file and returns its contents in the response body. Refer to the CERT.pl CVE-2026-7766 Analysis for technical details and proof-of-concept information.

Detection Methods for CVE-2026-7766

Indicators of Compromise

HTTP GET requests to the camera management panel containing traversal sequences such as ../, ..%2f, or encoded variants in query parameters or path segments.
Web server responses from camera devices returning content with file headers, shell configuration data, or binary payloads inconsistent with normal panel resources.
Unexpected outbound connections from monitoring workstations to camera management interfaces from untrusted hosts on the local network.

Detection Strategies

Inspect HTTP traffic destined for camera management panels for path traversal patterns in URLs and query strings.
Alert on responses from camera HTTP services that exceed typical resource sizes or contain text patterns matching system files such as /etc/passwd or device configuration markers.
Correlate access to camera management endpoints with the source address and device inventory to identify unauthenticated probing.

Monitoring Recommendations

Log all HTTP requests reaching camera management panels at the network gateway or VLAN boundary.
Monitor for repeated 200 OK responses to requests containing encoded traversal characters from a single source.
Audit camera firmware versions on a recurring schedule and flag devices running pre-patch releases.

How to Mitigate CVE-2026-7766

Immediate Actions Required

Update affected KG-5260xxxx-IL-(G)2 cameras to firmware version 2026-04-23 or later.
Update all other affected Kenik camera models to firmware version 2025-04-21 or later.
Restrict access to camera management interfaces using network segmentation and ACLs until patches are applied.
Rotate any credentials stored on or accessible from the camera, including stream and administrative passwords.

Patch Information

Kenik released fixed firmware versions addressing CVE-2026-7766. The KG-5260xxxx-IL-(G)2 camera series is fixed in version 2026-04-23. All other affected products are fixed in version 2025-04-21. Refer to the CERT.pl CVE-2026-7766 Analysis for vendor coordination details and firmware distribution information.

Workarounds

Place cameras on an isolated VLAN with no route to user workstations or the internet.
Block inbound traffic to the camera HTTP management port from all hosts except an administrative jump host.
Deploy a reverse proxy in front of camera management interfaces that filters requests containing traversal sequences.
Disable remote access to the management panel where local console administration is sufficient.

bash

# Example firewall rule restricting camera management access to a single admin host
iptables -A FORWARD -p tcp --dport 80 -d <camera_ip> -s <admin_host_ip> -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -d <camera_ip> -j DROP
iptables -A FORWARD -p tcp --dport 443 -d <camera_ip> -s <admin_host_ip> -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -d <camera_ip> -j DROP