Pelco Sarix Professional IWP 3 up to 02.52 Web Management Interface authentication bypass

Summaryinfo

A vulnerability marked as critical has been reported in Pelco Sarix Professional IMP 3, Sarix Professional IXP 3, Sarix Professional IBP 3 and Sarix Professional IWP 3 up to 02.52. This affects an unknown function of the component Web Management Interface. This manipulation causes authentication bypass. This vulnerability is tracked as CVE-2026-1241. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Pelco Sarix Professional IMP 3, Sarix Professional IXP 3, Sarix Professional IBP 3 and Sarix Professional IWP 3 up to 02.52. It has been declared as critical. Affected by this vulnerability is an unknown code of the component Web Management Interface. The manipulation with an unknown input leads to a authentication bypass vulnerability. The CWE definition for the vulnerability is CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. As an impact it is known to affect confidentiality. The summary by CVE is:

The Pelco, Inc. Sarix Professional 3 Series Cameras are vulnerable to an authentication bypass issue in their web management interface. The flaw stems from inadequate enforcement of access controls, allowing certain functionality to be accessed without proper authentication. This weakness can lead to unauthorized viewing of live video streams, creating privacy concerns and operational risks for organizations relying on these cameras. Additionally, it may expose operators to regulatory and compliance challenges.

The advisory is shared at cisa.gov. This vulnerability is known as CVE-2026-1241 since 01/20/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/26/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Pelco

Name

• Sarix Professional IBP 3
• Sarix Professional IMP 3
• Sarix Professional IWP 3
• Sarix Professional IXP 3

Version

• 02.0
• 02.1
• 02.2
• 02.3
• 02.4
• 02.5
• 02.6
• 02.7
• 02.8
• 02.9
• 02.10
• 02.11
• 02.12
• 02.13
• 02.14
• 02.15
• 02.16
• 02.17
• 02.18
• 02.19
• 02.20
• 02.21
• 02.22
• 02.23
• 02.24
• 02.25
• 02.26
• 02.27
• 02.28
• 02.29
• 02.30
• 02.31
• 02.32
• 02.33
• 02.34
• 02.35
• 02.36
• 02.37
• 02.38
• 02.39
• 02.40
• 02.41
• 02.42
• 02.43
• 02.44
• 02.45
• 02.46
• 02.47
• 02.48
• 02.49
• 02.50
• 02.51
• 02.52

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion