CVE-2025-13658

CRITICAL

Longwatch Devices - Unauthenticated Endpoint SYSTEM Code Execution

Title source: manual

Description

A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signing and execution controls. Exploitation results in SYSTEM-level privileges.

References (1)

Core 1

Core References

Third Party Advisory, US Government Resource government-resource

https://www.cisa.gov/news-events/ics-advisories/icsa-25-336-01

Scores

CVSS v4 9.3

EPSS 0.0060

EPSS Percentile 44.2%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-94

Status published

Products (1)

Industrial Video & Control/Longwatch 6.309 - 6.334

Published Dec 02, 2025

Tracked Since Feb 18, 2026