Penetration testers have uncovered a flaw in the request handling of the QND-8080R camera’s web server component that can allow an attacker to bypass normal authentication checks and call protected functions. The vulnerability is a classic example of an authentication bypass (CWE‑306), which could let an unauthenticated user control camera settings or access sensitive data without authorization.

Hanwha Vision’s QND‑8080R network cameras are affected. The vulnerability exists in the web server firmware that is shipped with these devices, and any device running the unpatched firmware is at risk. The vendor has released a firmware update to address the issue; specific firmware version numbers are not listed in the CVE data.

The CVSS score of 8.7 classifies this as a high‑severity flaw, and the lack of an EPSS score means the current exploitation likelihood is unspecified. The vulnerability is not listed in the CISA KEV catalog, but it can be exploited remotely by any host that can reach the camera’s HTTP/HTTPS interface. The likely attack vector is remote exploitation via the camera’s web interface, as the flaw resides in the web server component.