A path traversal flaw in the TRIFORA 3 series network cameras permits a logged-in user with monitoring or higher privileges to read arbitrary files from the device’s filesystem. The vulnerability is a classic content‑injection error (CWE‑22) that can lead to disclosure of configuration files, credentials, or other sensitive data, potentially compromising the camera’s security and the network it serves.

Devices from TOA Corporation’s TRIFORA 3 series network cameras are affected. Specific firmware or model versions are not enumerated in the advisory, indicating that all publicly offered TRIFORA 3 cameras may be vulnerable until a corrected firmware release is deployed.

The CVSS score of 7.1 reflects moderate to high impact, while the EPSS score of less than 1% suggests a low likelihood of public exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, and an attacker must be authenticated as at least a monitoring user to leverage the flaw. Consequently, the risk is primarily confined to environments where such accounts exist and the cameras are exposed to internal or trusted network traffic.