CVE-2018-14064

This is like having a lock on your front door that anyone can open just by asking in a certain way — no key needed. An attacker who can reach the camera over the network can read private files stored on it, potentially including passwords or configuration data, without ever logging in.

This matters to you if you use a VelotiSmart WiFi B-380 security camera, or any device running the uc-http service version 1.0.0. The flaw is reachable by default whenever the camera's web interface is exposed on the network, so if it's accessible from the internet or an untrusted network, it's at risk.

A public exploit for this flaw already exists, meaning attackers have what they need to use it, even though there's no confirmed evidence yet of active exploitation campaigns in the wild or a listing in CISA's known-exploited catalog. Combined with no password required and sustained press attention on this device, you should treat this as a real but not yet confirmed-active threat — isolate exposed devices promptly rather than waiting.

Confirm exposure by checking whether port 80 on the VelotiSmart WiFi B-380 (or any device running uc-http 1.0.0) is reachable from untrusted networks or the internet — a simple test is attempting a path-traversal request like GET /../../etc/passwd against the device from outside your network. There is currently no vendor-supplied fixed version for this CWE-22 path traversal flaw, so patching is not an option today. As a workaround, place the device behind a firewall/NAT, restrict access to a trusted internal VLAN only, disable any port-forwarding or UPnP rules exposing port 80, and consider a reverse proxy with path-traversal filtering if the device must remain reachable. Monitor vendor channels and security advisories for a firmware release, and watch device logs for anomalous HTTP requests containing traversal sequences (e.g. ../). Given a public exploit exists and EPSS places this in a high percentile, treat exposed devices as a priority even though this is not yet in CISA KEV.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no privileges or interaction needed, high impact to confidentiality, integrity, and availability. Weakness is CWE-22 (Path Traversal) in the uc-http service, allowing arbitrary file disclosure via crafted URIs (e.g. /../../etc/passwd) on TCP port 80. A public exploit is known to exist (exploit maturity: functional PoC), EPSS is 37.2% (98th percentile) with a falling trend, indicating elevated but not top-tier predicted exploitation likelihood. Not listed in CISA KEV, so no confirmed active-exploitation evidence per that source. No patch/fix information is currently available from the vendor.