CVE-2026-40624 describes a critical vulnerability in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras caused by improper input validation (CWE-552). This vulnerability enables remote, unauthenticated attackers to achieve arbitrary code execution via specially crafted web requests. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. The vulnerability affects all versions of the mentioned camera models. No vendor advisory or patch information is currently available, and no exploits are known to be active in the wild.

Successful exploitation allows remote attackers to execute arbitrary code on affected devices without authentication, potentially leading to full compromise of the camera systems. This impacts confidentiality, integrity, and availability of the devices and any connected networks or systems relying on them.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to affected devices, especially from untrusted networks, and monitor for unusual activity. Avoid exposing these devices directly to the internet.