CVE-2017-5174: Geutebruck IP Camera authentication bypass enabling remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required, high EPSS, and public exploit code make this an urgent patch-or-isolate case despite no KEV listing.

What it is

Geutebruck IP Camera G-Cam/EFD-2250 firmware 1.11.0.12 contains an authentication bypass in which the file system architecture allows attackers to circumvent access controls. Successful bypass can lead to remote code execution on the camera. The flaw is remotely reachable without credentials, making exposed cameras a serious risk.

Impact

An unauthenticated attacker gains full control of the affected camera, with high confidentiality, integrity and availability impact, and can execute code on the device. This can expose video feeds and provide a foothold into the camera's network segment.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges or user interaction required (PR:N, UI:N), so any host that can reach the camera's web or management interface can attempt it. No authentication is needed to trigger the bypass.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.52 (98.9th percentile) and a public Exploit-DB entry (41360) exists, indicating exploit code is publicly available. No ransomware association is documented.

What to do

• Apply the vendor firmware update for G-Cam/EFD-2250 that addresses the authentication bypass; consult the Geutebruck advisory referenced by ICSA-17-045-02 for the fixed version.
• If patching is not immediately possible, remove cameras from direct internet exposure and place them behind a firewall or VPN with strict allowlists.
• Segment camera networks from business and user networks, and block inbound access to camera management interfaces from untrusted zones.
• Change default credentials and disable unused services on the camera as a defense-in-depth measure.
• Monitor vendor and ICS-CERT advisories for updated guidance on this product line.

Detection

• Review camera and perimeter logs for unauthenticated requests to management or file-system paths that precede unexpected process execution or configuration changes.
• Alert on new or unusual outbound connections from camera IP addresses, which may indicate post-exploitation activity.
• Use network monitoring to detect exploit traffic matching public PoC patterns against the camera's web interface.
• Audit camera firmware versions across the estate to identify devices still running 1.11.0.12 or other unpatched builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.