Two KMW IP security cameras carry a critical unauthenticated password reset flaw that hands an attacker full control over live feeds and device settings.
The vulnerability, CVE-2026-5386, affects the KM-IP521 and KM-IP421 models from Romanian vendor KMW. Scored 9.1 (Critical) on the CVSS scale, the bug lets anyone on the network remotely reset the administrator password to a known value without supplying existing credentials. From there, the attacker reads live video and rewrites configuration at will. KMW has issued firmware patches for both models, though KM-IP421 owners should know the update terminates their cloud P2P connection and requires a call to customer support to restore it.
These are not niche consumer gadgets. The affected deployment sectors include commercial facilities, government buildings, financial services, critical manufacturing, and transportation systems, spread across multiple countries. An unauthenticated password reset is among the most elementary failures possible in IP camera design, which suggests the administrative endpoints shipped without meaningful authentication review.
No exploitation has been reported yet, which is the kind of qualifier that should prompt immediate patching rather than a sigh of relief.