SB2025092361 - Multiple vulnerabilities in Cognex In-Sight Explorer and In-Sight Camera Firmware
Published: September 23, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Use of Hard-coded Password (CVE-ID: CVE-2025-54754)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to use a hard-coded password. A remote attacker on the local network can retrieve a hard-coded password embedded in publicly available software.
2) Cleartext transmission of sensitive information (CVE-ID: CVE-2025-47698)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to software uses insecure communication channel to transmit sensitive information. A remote attacker with ability to intercept network traffic can gain access to sensitive data.
3) Incorrect default permissions (CVE-ID: CVE-2025-53947)
The vulnerability allows a local user to compromise the target system.
The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user can corrupt sensitive data and modify data folder´s content.
4) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2025-54860)
The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the affected module does not limit the number of password attempts. A local user can perform a brute-force attack and perform a denial of service (DoS) attack on the system.
5) Incorrect permission assignment for critical resource (CVE-ID: CVE-2025-52873)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to incorrect permission assignment for critical resource. A remote user can invoke the SetSystemConfig functionality to modify relevant device properties.
6) Incorrect permission assignment for critical resource (CVE-ID: CVE-2025-54497)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to incorrect permission assignment for critical resource. A remote user can invoke the SetSerialPort functionality to modify relevant device properties.
7) Cleartext transmission of sensitive information (CVE-ID: CVE-2025-54818)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to software uses insecure communication channel to transmit sensitive information within the user management functionality. A remote attacker with ability to intercept network traffic can gain access to the target device.
8) Authentication Bypass by Capture-replay (CVE-ID: CVE-2025-54810)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to authentication bypass by capture-replay. A remote attacker on the local network can capture the encrypted password, perform the replay attack and gain unauthorized access on the target device.
9) Client-Side Enforcement of Server-Side Security (CVE-ID: CVE-2025-53969)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient client-side validation. A remote user on the local network can perform management operations such as changing network settings or modifying users' access to the device.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.