Skip to main content

CISA issues alert on authentication flaws in iCam365 P201 and QC021 cameras

Source Decision Insights Threat Desk Published November 27, 2025 Companies 1
Human View Machine View

339th article in the last 90 days, one of 449 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues six advisories on vulnerabilities in industrial control systems (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Practitioner
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

Security flaws have been identified in iCam365's P201 and QC021 camera models, involving the absence of authentication controls on critical functions which could lead to unauthorized data access.

The vulnerabilities have been assigned the identifiers CVE-2025-64770 and CVE-2025-62674. The P201 and QC021 models, up to firmware version 43.4.0.0, permit unauthenticated access to Open Network Video Interface Forum (ONVIF) services and Real Time Streaming Protocol (RTSP) services. This flaw allows attackers to access camera configuration details without proper authentication. Both issues share the Common Weakness Enumeration designation CWE-306, “Missing Authentication for Critical Function.” The Common Vulnerability Scoring System (CVSS) version 3.1 base score for each vulnerability is 6.8, and the CVSS version 4.0 base score is 7.0, with vectors Antivirus Software (AV):A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L for version 3.1 and AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N for version 4.0.

Exploitation of these vulnerabilities may lead to unauthorized disclosure of live video streams and configuration information of the affected cameras.

At the time of reporting, iCam365 had not responded to coordination requests regarding these vulnerabilities. Users are advised to contact iCam365 directly for further updates. No public demonstrations or reports of exploitation targeting these vulnerabilities have been identified. The vulnerabilities are not exploitable remotely without network access.

Recommendations include limiting network exposure of the cameras by ensuring they are not accessible via the Internet and positioning them behind firewalls separated from business networks. When remote access is required, the use of secure methods such as Virtual Private Networks (VPNs) is advised, acknowledging that VPNs require maintenance and updates to remain secure and their security depends on the connected devices.

Organizations are encouraged to conduct appropriate impact assessments and risk evaluations before deploying any defensive measures. Additional advisory resources and recommended practices for industrial control systems security are available through official channels, with incident reporting procedures established for suspected malicious activities associated with these vulnerabilities.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-authentication-flaws-in-icam365-p201-and-qc021-cameras/",
        "name": "CISA issues alert on authentication flaws in iCam365 P201 and QC021 cameras",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-authentication-flaws-in-icam365-p201-and-qc021-cameras/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "articleSection": [
      "Cybersecurity",
      "AI infrastructure"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Practitioner"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:24:07-06:00",
    "datePublished": "2025-11-27T11:28:51-07:00",
    "description": "CISA reports vulnerabilities in iCam365 P201 and QC021 cameras allowing unauthorized access to video streams and configurations due to missing authentication.",
    "headline": "CISA issues alert on authentication flaws in iCam365 P201 and QC021 cameras",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-02"
    },
    "keywords": [
      "Antivirus Software",
      "Authentication",
      "Common Vulnerability Scoring System",
      "Services",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-authentication-flaws-in-icam365-p201-and-qc021-cameras/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages