CVE-2026-18192 HIGH

CVE-2026-18192: Vacron｜IP Camera - Arbitrary File Read

Vendor Vacron

Product VIN-DS783E-E6

Weakness CWE-23

Published July 29, 2026

Last update July 29, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

Key dates

02Disclosure timeline

July 29, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-18192 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/23.html AskarLabs — CWE-23 write-up Relative Path Traversal

Related vulnerabilities

04Related CVE

CVE-2024-13791 Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function CVE-2023-6825 File Manager And File Manager Pro (Multiple Versions) - Directory Traversal CVE-2025-47445 WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability CVE-2025-25130 WordPress Delete Comments By Status plugin <= 1.5.3 - Local File Inclusion vulnerability CVE-2025-2007 Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion