An improper input validation flaw exists in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras. The vulnerability permits a remote, unauthenticated attacker to send a specially crafted web request that results in arbitrary code execution on the device. With arbitrary code execution, an attacker could compromise the camera, exfiltrate data, tamper with recordings, or disrupt network operations, impacting confidentiality, integrity, and availability.

The flaw affects AVer camera models PTC115, PTC115+, PTC500+, and PTC500S. No specific firmware versions are listed, so all currently deployed units of these models are potentially vulnerable unless patched.

The CVSS score of 9.3 reflects critical severity, and the lack of an EPSS score does not diminish the high risk implied by the CVSS. The vulnerability is not yet listed in the CISA KEV catalog. The attack vector is remote via the camera's web interface, requiring no authentication, making exploitation highly likely if the device is reachable from an external or compromised network.