CVE-2019-25236 iSeeQ Hybrid DVR WH-H4 1.03R Unauthenticated Live Stream Disclosure
Attackers can access live video streams and snapshots from iSeeQ Hybrid DVRs without authentication via the get_jpeg endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25236?
CVE-2019-25236 is a high-severity missing authorization vulnerability in iSeeQ Hybrid DVR WH-H4, published on 24 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
iSeeQ Hybrid DVR WH-H4 1.03R contains an unauthenticated vulnerability in the get_jpeg script that allows unauthorized access to live video streams. Attackers can retrieve video snapshots from specific camera channels by sending requests to the /cgi-bin/get_jpeg endpoint without authentication.
Weakness: CWE-306
Which versions are affected by CVE-2019-25236?
How do I fix CVE-2019-25236?
No fix has been published for CVE-2019-25236 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-25236 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25236 exists.
Sources
Also known as GHSA-pmc3-hmfh-583m.