CVE-2026-5386 is a critical unauthenticated password reset vulnerability in KMW KM-IP521 CCTV cameras (version 4.04.91.230307). The vulnerability allows remote attackers to reset the administrator password to a known value without any authentication, granting full control over camera feeds and device settings. This is classified under CWE-620 (Unverified Password Change). The CVSS 3.1 score of 9.1 reflects high impact on confidentiality and integrity with no required privileges or user interaction. No official patch or remediation guidance is currently available from the vendor. The product is not a cloud service, so remediation depends on vendor patching or device replacement.

Successful exploitation results in complete compromise of the affected CCTV camera, including unauthorized access to live video feeds and administrative settings. This can lead to severe confidentiality breaches and unauthorized control over the device. Availability is not impacted. The vulnerability requires no authentication and can be exploited remotely, making it highly critical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected devices to trusted networks only, and monitor for any suspicious activity. Consider device replacement if critical security requirements cannot be met. Do not rely on default or known passwords.