Path Traversal in Kenik cameras

Vulnerability

The Kenik camera management panel (software for models KG-5230TAS-IL-3, KG-5230TAS-IL-G3, KG-5230DAS-IL-G3, KG-5260TZAS-IL-3, KG-5260DZAS-IL-3, KG-5260TZAS-IL-G3, KG-5260DZAS-IL-G3, and KG-5260xxxx-IL-(G)2) suffers from a path traversal vulnerability (CWE-22) in its web interface. An unauthenticated attacker can send a specially crafted GET request with an arbitrary file path, and the server will read and return the contents of files outside the intended web root. All software versions before the respective fix dates are affected: for the KG-5260xxxx-IL-(G)2 models, all versions before 2026-04-23; for the other listed products, all versions before 2025-04-21 [1].

Exploitation

The attacker does not need any authentication or prior access. The only requirement is network connectivity to the vulnerable camera's management panel. The attacker sends a GET request to the web server with a path traversal sequence (e.g., ../) in the URL parameter, specifying an arbitrary file path on the server's filesystem. The server processes the request without proper validation or sanitization, and returns the file content in the HTTP response [1].

Impact

A successful exploit allows an unauthenticated attacker to read arbitrary files on the server, including configuration files, credentials, or other sensitive data. This constitutes a high-impact information disclosure that could facilitate further compromise of the device or network. The vulnerability does not require any user interaction or special privileges, making it easily exploitable by anyone with network access [1].

Mitigation

Kenik has released fixed firmware versions. For the KG-5260xxxx-IL-(G)2 series, the fix is included in the version dated 2026-04-23. For all other affected products (KG-5230TAS-IL-3, KG-5230TAS-IL-G3, KG-5230DAS-IL-G3, KG-5260TZAS-IL-3, KG-5260DZAS-IL-3, KG-5260TZAS-IL-G3, KG-5260DZAS-IL-G3), the fix is in the version dated 2025-04-21. Users should update their camera firmware to the latest version. No workaround is mentioned in the available references, and the vulnerability is not listed on the CISA KEV as of this publication [1].