InfoSecBulletin Cybersecurity for mankind
A severe vulnerability (CVE-2025-7503) has been found in an IP camera from Shenzhen Liandian Communication Technology LTD. With a CVSSv4 score of 10, this issue allows attackers root access via an undocumented Telnet service, threatening privacy and security.
The vulnerability lies in the camera’s firmware (AppFHE1_V1.0.6.0) and its associated kernel (KerFHE1_PTZ_WIFI_V3.1.1) and hardware (HwFHE1_WF6_PTZ_WIFI_20201218). The device exposes a Telnet service on port 23, which is:
Enabled by default
Not mentioned in the user manual
Inaccessible via the web interface or mobile app
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
Even more disturbing, attackers can connect to this service using hard-coded credentials, granting immediate root shell access. As the CVE description notes, “an attacker with network access can authenticate using default credentials and gain root-level shell access to the device.”
Security researchers couldn’t reach the vendor, so no firmware update or official statement has been released. The report highlights that the vendor does not allow disabling Telnet. Users cannot change or remove credentials, and there’s no option to turn off the Telnet service.
This level of access allows an attacker to:
View or redirect live camera feeds
Modify the filesystem
Launch network-based attacks from the device
Implant persistent malware or backdoors
CVE-2025-7503 affects more than just one camera model; it highlights issues with low-cost OEM IoT devices that often have insecure defaults and undocumented features.
Attackers with root shell access can fully control the device. The advisory states: “Root shell access provides total control over the device, including its filesystem, networking, and camera feeds.”
In large places like offices, schools, and public areas, such access can enable surveillance, manipulation, or use of cameras for internal attacks.
While there’s no vendor fix, affected users can take defensive steps:
Isolate IP cameras from main networks using VLANs
Block Telnet (port 23) at the network level via firewall rules
Monitor outbound traffic for unusual behavior
Replace the device if you require hardened security and vendor support
