The VIN‑DS783E‑E6 IP camera, manufactured by Vacron, contains a hidden functionality flaw that allows an unauthenticated remote attacker to trigger a covert operation and capture the device's administrator credentials. Identified as CWE‑912, this vulnerability results in credential theft, giving an attacker the ability to use administrative credentials on the camera.

Affected systems include the Vacron VIN‑DS783E‑E6 IP camera models. No additional version range information is provided, implying that the default stock firmware of the specified model is vulnerable.

The CVSS score of 9.3 reflects a high severity flaw. The EPSS score of less than 1 percent indicates a low but non‑zero likelihood of exploitation, while the vulnerability is not listed in the CISA KEV catalog, meaning no publicly known active exploits currently exist. The attack vector is inferred to be remote and unauthenticated, leveraging a hidden endpoint that can be accessed over the network. Successful exploitation requires network connectivity to the camera and the ability to send crafted requests to that hidden interface.