The vulnerability allows an attacker to insert and execute arbitrary operating‑system commands on the camera device because user input is not properly validated when processed by the firmware. This weakness, identified as CWE‑78, enables full control of the affected device, leaking any stored data, tampering with configurations, and potentially allowing further lateral movement within the network.

The flaw affects Hanwha Vision QND‑8080R camera systems. No specific firmware versions are listed in the vendor notice, so all releases of this product are potentially vulnerable until a patch is applied.

The CVSS score of 8.5 indicates high severity. EPSS information is not available, and the vulnerability is not included in CISA’s KEV catalog. Based on the description and the fact that Amazon penetration‑testing engineers discovered the issue through externally crafted requests, the likely attack vector is remote, via the camera’s network interface. An attacker who can send a request to the camera can execute arbitrary commands, although no additional prerequisites such as privilege escalation or specific configuration settings are noted in the advisory.