CVE-2025-13658

published 2025-12-02

CVE-2025-13658: A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code…

Priority P2 67 critical 9.3 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signing and execution controls. Exploitation results in SYSTEM-level privileges.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
industrial_video_control	longwatch	6.309 – 6.334	—

Detection & IOCs extracted from sources · hover to see the quote

• → Detect unauthenticated HTTP GET requests targeting the exposed Longwatch endpoint that triggers code execution ↗
• → Successful exploitation results in SYSTEM-level process privileges; monitor for unexpected SYSTEM-level child processes spawned from the Longwatch service ↗
• → Affected versions are Longwatch 6.309 through 6.334; flag any internet-exposed instances of these versions as high-priority targets ↗

• · No specific vulnerable endpoint path, payload structure, or network port is publicly disclosed in available sources; detection rules cannot be narrowed beyond generic unauthenticated HTTP GET traffic to Longwatch devices ↗
• · No known public exploitation has been reported at time of advisory publication, limiting availability of real-world IOCs ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94