No Patches for Vulnerabilities Allowing Cognex Industrial Camera Hacking

Cognex has announced that some of its industrial cameras are affected by vulnerabilities that, despite being potentially serious, will not receive patches. According to CISA, nine flaws affect In-Sight 2000, 7000, 8000, and 9000 vision systems and the In-Sight Explorer client software, with issues including a hardcoded password, cleartext transmission of sensitive information, incorrect default permissions, DoS, privilege escalation, and authentication bypass, the majority rated high severity.

Nozomi Networks disclosed additional details this week and described three theoretical attack scenarios, including unauthenticated MitM access to a network segment housing the camera to intercept credentials, a low-privilege attacker gaining admin permissions, and a similar scenario causing disruptions via the engineering workstation.

Because the affected cameras are typically used in closed environments, they cannot be exploited directly from the internet, but a network-homed attacker can exploit the flaws to hack cameras and linked systems.

Cognex advises migrating to newer In-Sight 2800, 3800, and 8900 series cameras and Nozomi and CISA recommend mitigations such as limiting network exposure, segmenting control networks, isolating them from business networks, using VPNs for remote access, and deploying detection/blocking cybersecurity products. 26 September 2025