PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-6118 Neutron CVE debrief

CVE-2023-6118 is a high-severity absolute path traversal issue in Neutron IP Camera firmware before b1130.1.0.1. The flaw is described as a '/../filedir' traversal problem and is network-reachable according to the NVD CVSS vector. In practical defensive terms, affected camera firmware may allow unintended file access on vulnerable devices, so exposed or poorly segmented IP cameras should be treated as a priority remediation item.

Vendor
Neutron
Product
IP Camera
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2023-11-23
Original CVE updated
2026-05-20
Advisory published
2023-11-23
Advisory updated
2026-05-20

Who should care

Teams that own, operate, or secure Neutron IP cameras and related surveillance networks, including IT, OT, physical security, MSPs, and any environment with externally reachable camera management interfaces.

Technical summary

The NVD record maps CVE-2023-6118 to CWE-22 (path traversal) and lists a secondary USOM classification of CWE-25. The issue affects multiple Neutron IP camera firmware families, including NEU-IPB210-28, NTL-PT-06WOD-3MP, NEU-IPB410-28, NTL-BC-01W, NEU-IPBM211, NTL-PT-09-WOS-3MP, NEU-IPBM411, NTL-PT-10-4GWOS-3MP, IPC2224-SR3-NPF-36, IPC2624-SR3-NPF-36, NTL-BC-03-SNM, NTL-BC-03-SNP, NEU-IPD220-28, NTL-BC01-M, NEU-IPDM221, NEU-IPDM421, and NTL-IP05-3MP firmware builds before b1130.1.0.1. NVD rates the flaw 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating a network-exploitable confidentiality impact.

Defensive priority

High. Prioritize rapid firmware remediation and exposure reduction for any Neutron IP camera running firmware earlier than b1130.1.0.1, especially if management or device interfaces are reachable from untrusted networks.

Recommended defensive actions

  • Inventory Neutron camera models and firmware versions, then compare them against the affected CPE list and the b1130.1.0.1 cutoff.
  • Apply vendor firmware updates to version b1130.1.0.1 or later where available.
  • If patching is delayed, restrict management access to trusted administrative networks and isolate cameras with segmentation.
  • Remove direct internet exposure for camera management interfaces; use VPN or equivalent controlled access paths.
  • Monitor device and network telemetry for unexpected file-access behavior or traversal-related requests on exposed cameras.

Evidence notes

CVE-2023-6118 was published on 2023-11-23 and last modified by NVD on 2026-05-20. The supplied NVD record lists CVSS 3.1 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and identifies CWE-22 as the primary weakness. The same record includes USOM references that classify the issue as CWE-25 as well. The affected scope in the NVD CPE data is limited to specific Neutron IP camera firmware families before b1130.1.0.1.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-6118 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-6118

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-6118 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-6118

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.