This vulnerability (CVE-2026-12527) affects the V380 IP Camera firmware AppFHE1_V1.0.6.0 by Shenzhen Liandian Communication Technology LTD. It is classified as CWE-306 (Missing Authentication for Critical Function). The flaw exists in the RTSP media delivery pipeline, where an attacker without authentication can bypass the device's credential-enforced live-view workflow and directly retrieve real-time video stream data. The CVSS 4.0 vector indicates the attack requires adjacent network access with low complexity and no privileges or user interaction, resulting in high confidentiality impact and partial scope change. No vendor advisory or patch information is available to confirm remediation status.

An unauthenticated attacker on the adjacent network can bypass authentication controls to access live video streams from the affected IP camera. This compromises the confidentiality of the video data, potentially exposing sensitive surveillance footage. There is no indication of impact on integrity or availability. The vulnerability does not require user interaction or privileges, increasing the risk of unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict network access to the device, especially limiting access to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.