CISA Warns: Critical Longwatch RCE Flaw (CVE-2025-13658, CVSS 9.8) Allows Unauthenticated SYSTEM Takeover of OT Surveillance

According to The Cybersecurity and Infrastructure Security Agency (CISA), a critical vulnerability in Industrial Video & Control’s Longwatch video surveillance and monitoring system could allow an unauthenticated attacker to seize control with SYSTEM-level privileges.

Tracked as CVE-2025-13658, the flaw carries a CVSS v3.1 base score of 9.8 and is categorised as “Improper Control of Generation of Code.” It stems from how the device handles incoming web traffic and enables unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint due to the absence of code signing and execution controls. The vulnerability affects Longwatch versions 6.309 to 6.334, with a patch advising users to upgrade to version 6.335 or later.

The advisory notes that successful exploitation could grant remote code execution with elevated privileges, giving an attacker full control over the surveillance server, and the report credits the finding to a “Concerned OT Engineer.” The issue has been addressed by Industrial Video & Control, who released the fix for users of the affected versions.