Critical CCTV Flaw (CVE-2025-13607) Risks Video Feed Hijack & Credential Theft via Missing Authentication

The CVE-2025-13607 flaw has prompted a high-severity alert from The Cybersecurity and Infrastructure Security Agency (CISA), warning that networked CCTV cameras could be hijacked to view private feeds and steal administrative credentials.

Described as “Missing Authentication for Critical Function,” the vulnerability lets an attacker bypass security checks and access camera configuration information, including account credentials, without authenticating when visiting a vulnerable URL, potentially enabling remote credential theft and further network pivoting. It is identified as CVSS 9.4, signalling urgent risk for organisations using affected surveillance hardware.

The advisory explicitly lists the D-Link DCS-F5614-L1 camera (versions v1.03.038 and earlier) as affected, with D-Link releasing firmware V1.03.039a0340.02i46061.T078.2 to address the issue; administrators are urged to apply the update immediately. The report notes that the vulnerability may extend to equipment from Securus CCTV and Sparsh Securitech, but communications from those vendors have been unanswered, leaving affected models for those brands not yet confirmed.

If you operate the DCS-F5614-L1, update now; for Securus or Sparsh devices, CISA recommends contacting customer service to determine if a given model is affected and whether patches exist.