CVE-2026-5386: Kmw Km-IP421

Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days.

The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated password reset. This flaw allows an attacker to remotely reset the administrator password to a known value without authentication, granting full access to the camera feeds and settings.

Affected products

• Kmw Km-IP421: version 4.04.53.210416 only
• Kmw Km-IP521: version 4.04.91.230307 only

Published 2026-05-29. Last modified 2026-07-22.