Technical impact
The vulnerability is an OS command injection flaw in TOA Corporation’s TRIFORA 3 series network cameras. It allows an authenticated user with monitoring or higher privileges to inject and run arbitrary operating‑system commands, providing full control over the device’s firmware. This is classified as CWE‑78. Based on the description, it is inferred that the attacker can alter the camera's behavior or exfiltrate data, although the exact extent is not detailed in the CVE.
Affected Systems
The affected equipment is the TRIFORA 3 series network cameras from TOA Corporation. No specific firmware versions are listed, so any camera running the vulnerable firmware should be considered at risk until an updated image is applied.
Risk and Exploitability
The CVSS score of 8.7 places the vulnerability in the high‑risk category, and the EPSS score of 1.5% indicates a low but nonzero probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector requires an attacker to authenticate to the camera’s administrative interface as a monitoring or higher privilege user, then send crafted input to trigger the command injection. Based on the description, it is inferred that successful exploitation results in arbitrary code execution on the device, potentially enabling lateral movement or data exfiltration.
