CVE-2019-25247 Beward N100 H.264 VGA IP Camera M2.1.6 CSRF Add Admin Vulnerability
Attackers can trick logged-in users into adding an admin account via CSRF, leading to unauthorized administrative access on the IP camera.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-25247?
CVE-2019-25247 is a medium-severity vulnerability in Beward R&D Co., Ltd N100 H.264 VGA IP Camera, published on 24 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Beward N100 H.264 VGA IP Camera M2.1.6 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft a malicious web page with a hidden form to add an admin user by tricking a logged-in user into submitting the form.
Weakness: CWE-352
Which versions are affected by CVE-2019-25247?
How do I fix CVE-2019-25247?
No fix has been published for CVE-2019-25247 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-25247 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25247 exists.
Sources
Also known as GHSA-rc3h-p7vv-v9x3.