The CVE describes a design flaw in H.VIEW IP cameras that allows authenticated users to store arbitrary file content to fixed, persistent locations normally reserved for certificate material. Because the system does not validate file type, structure, or size, an attacker can overwrite certificate files with malicious data, potentially altering authentication behavior or causing unintended system behavior after reboot. This is a CWE-434 (Unrestricted Upload of File with Dangerous Type) flaw affecting system integrity.

The vulnerability is present in H.VIEW HV-500S6 IP Cameras. No specific firmware or version information is listed, so all devices of this model are potentially impacted until a patch or mitigation is applied.

The CVSS score of 8.6 indicates a high‑severity vulnerability. There is no EPSS score or KEV listing, but the attack requires authenticated access to the camera’s certificate‑upload service. An internal attacker or a compromised account could exploit the flaw to replace critical certificate files, leading to integrity compromise or denial of service after a reboot. Because the vulnerability allows arbitrary file placement, the exploitation likelihood is significant for privileged users, and no patch is currently available.