{"id":"CVE-2026-1241","state":"PUBLISHED","title":"Authentication Bypass Using an Alternate Path or Channel in Pelco, Inc. Sarix Pro 3 Series IP Cameras","description":"The Pelco, Inc. Sarix Professional 3 Series Cameras are vulnerable to an authentication bypass issue in their web management interface. The flaw stems from inadequate enforcement of access controls, allowing certain functionality to be accessed without proper authentication. This weakness can lead to unauthorized viewing of live video streams, creating privacy concerns and operational risks for organizations relying on these cameras. Additionally, it may expose operators to regulatory and compliance challenges.","publishedAt":"2026-02-26T19:21:26.754Z","updatedAt":"2026-02-26T20:43:53.216Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Pelco, Inc. Sarix Professional IMP 3 Series","Pelco, Inc. Sarix Professional IXP 3 Series","Pelco, Inc. Sarix Professional IBP 3 Series","Pelco, Inc. Sarix Professional IWP 3 Series"],"affected":[{"vendor":"Pelco, Inc.","product":"Sarix Professional IMP 3 Series","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"02.52","versionType":"custom"}]},{"vendor":"Pelco, Inc.","product":"Sarix Professional IXP 3 Series","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"02.52","versionType":"custom"}]},{"vendor":"Pelco, Inc.","product":"Sarix Professional IBP 3 Series","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"02.52","versionType":"custom"}]},{"vendor":"Pelco, Inc.","product":"Sarix Professional IWP 3 Series","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"02.52","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-02"],"weaknesses":["CWE-288"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/1xxx/CVE-2026-1241.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1241","state":"PUBLISHED","datePublished":"2026-02-26T19:21:26.754Z","dateUpdated":"2026-02-26T20:43:53.216Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2026-01-20T18:26:34.854Z"},"containers":{"cna":{"title":"Authentication Bypass Using an Alternate Path or Channel in Pelco, Inc. Sarix Pro 3 Series IP Cameras","descriptions":[{"lang":"en","value":"The Pelco, Inc. Sarix Professional 3 Series Cameras are vulnerable to an authentication bypass issue in their web management interface. The flaw stems from inadequate enforcement of access controls, allowing certain functionality to be accessed without proper authentication. This weakness can lead to unauthorized viewing of live video streams, creating privacy concerns and operational risks for organizations relying on these cameras. Additionally, it may expose operators to regulatory and compliance challenges."}],"affected":[{"vendor":"Pelco, Inc.","product":"Sarix Professional IMP 3 Series","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"02.52","versionType":"custom"}]},{"vendor":"Pelco, Inc.","product":"Sarix Professional IXP 3 Series","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"02.52","versionType":"custom"}]},{"vendor":"Pelco, Inc.","product":"Sarix Professional IBP 3 Series","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"02.52","versionType":"custom"}]},{"vendor":"Pelco, Inc.","product":"Sarix Professional IWP 3 Series","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"02.52","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-02"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-288","description":"CWE-288 Authentication Bypass Using an Alternate Path or Channel","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2026-02-26T19:21:26.754Z"},"credits":[{"lang":"en","type":"reporter","value":"Souvik Kandar"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Pelco, Inc. recommends that all Sarix Professional 3 Series Camera users update their camera firmware to version 02.53 or later. Installing the latest firmware ensures your device receives the most up-to-date bug fixes and critical security enhancements.<br><br>More information can be found by visiting Pelco, Inc's technical support page (<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.pelco.com/support\">https://www.pelco.com/support</a>) for assistance.<br>"}],"value":"Pelco, Inc. recommends that all Sarix Professional 3 Series Camera users update their camera firmware to version 02.53 or later. Installing the latest firmware ensures your device receives the most up-to-date bug fixes and critical security enhancements.\n\nMore information can be found by visiting Pelco, Inc's technical support page ( https://www.pelco.com/support ) for assistance."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-26T20:43:12.875844Z","id":"CVE-2026-1241","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T20:43:53.216Z"}}]}}}