Path Traversal in Beward R&d Co., Ltd N100 H.264 Vga Ip Camera
CVE-2019-25246
Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability that allows attackers to read arbitrary system files via the 'READ.filePath' parameter. Attackers can exploit the fileread script or SendCGICMD API to access sensitive files like /etc/passwd and /etc/issue by supplying absolute file paths.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.189 (97.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.189 · newest: 0.189 · change: 0.000
Affected products
- Beward R&d Co., Ltd N100 H.264 Vga Ip Camera — versions M2.1.6.04C014
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/46320 (exploit)
- www.beward.net (product)
- www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5511.php (third-party-advisory)
Frequently asked questions
- What is CVE-2019-25246?
- CVE-2019-25246 is a high-severity vulnerability in Beward R&d Co., Ltd N100 H.264 Vga Ip Camera, classified under Path Traversal. CVSS score: 8.8/10. Published 2025-12-24.
- How severe is CVE-2019-25246?
- High severity. CVSS v3 base score is 8.8 out of 10.