CVE-2025-67158 — Revotech I6032W-FHW

Summary

The Revotech I6032W-FHW IP camera firmware contains an authentication bypass vulnerability in the /cgi-bin/jvsweb.cgi endpoint. The device does not validate the user.name and user.digest fields included in JSON-based API requests, allowing unauthenticated attackers to invoke administrative methods and retrieve sensitive information.

Vulnerability type: Incorrect Access Control / Improper Authentication
Impact: Remote Information Disclosure, Privilege Escalation
CVSS v3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

---

Affected Devices (Observed)

Brand	Model	Firmware Version	Platform / Notes
Revotech	I6032W-FHW	V1.0.0014 (2021-05-17)	Jovision-based firmware (FH8852-SW-2053-WU-F3, UI V2.0)

---

Proof-of-Concept Disclosure Notice

Reproduction details and raw evidence (PoC requests, PCAPs, and device responses) are withheld from public disclosure due to the high risk of abuse. Authorized parties (vendors, CERTs, CNAs) may request additional technical details after verification.

---

Additional Observations

• The /cgi-bin/jvsweb.cgi endpoint accepts JSON-formatted commands without enforcing authentication checks.
• Administrative API methods such as account_get_users can be executed using arbitrary user.name and user.digest values.
• Identical administrative responses are returned regardless of credential validity, demonstrating that authentication is not enforced server-side.

---

Impact

• Unauthenticated attackers can access administrative API functionality.
• Sensitive user and account information can be disclosed remotely.
• The vulnerability enables privilege escalation without valid credentials.
• The issue may be leveraged as a building block for further device compromise.

---

Mitigation / Recommendations

1. Enforce strict server-side validation of authentication fields for all API requests.
2. Reject any request with invalid or missing authentication data.
3. Require a verified session before allowing access to administrative API methods.
4. Apply firmware updates provided by the vendor when available.
5. Restrict network access to the device management interface.
6. Monitor and log abnormal or repeated access attempts to /cgi-bin/jvsweb.cgi.

---

References

• NVD Entry
• CVE.org Entry

---

Summary

A vulnerability was identified in the Revotech I6032W-FHW IP camera firmware where authentication verification is not performed on the /cgi-bin/jvsweb.cgi endpoint.
An attacker can invoke administrative API methods simply by sending a request containing arbitrary user.name and user.digest values, thereby gaining access to sensitive information.

Vulnerability type: Insufficient Access Control / Improper Authentication
Impact: Remote Information Disclosure, Privilege Escalation
CVSS v3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

---

Affected Devices (Confirmed Cases)

Manufacturer	Model	Firmware Version	Notes
Revotech	I6032W-FHW	V1.0.0014 (2021-05-17)	Jovision-based firmware (FH8852-SW-2053-WU-F3, UI V2.0)

---

Proof-of-Concept (Reproduction Materials) Non-Disclosure Notice

Reproduction procedures and raw evidence (PoC requests, PCAPs, device response logs, etc.) are not disclosed due to the risk of abuse. Authorized organizations such as vendors, CERTs, and CNAs may request additional technical information after verification.

---

Additional Observations

• The /cgi-bin/jvsweb.cgi API trusts the authentication information provided by the client and does not perform separate server-side verification.
• Identical administrative-level API responses are returned regardless of authentication status.

---

Impact

• Unauthorized access to the device API is possible without authentication.
• Exposure of administrative-level information increases the possibility of further attacks.
• The vulnerability is remotely reproducible and does not require user interaction.

---

Mitigation Recommendations

1. Enforce server-side authentication verification for all API requests.
2. Verify session and credential validity before invoking administrative APIs.
3. Restrict network access to the management interface.
4. Apply security updates provided by the vendor.
5. Monitor and log abnormal API access patterns.

---

References

• NVD Entry
• CVE.org Entry