CVE-2026-120337 VStarcam CVE debrief

Who should care

Defenders responsible for VStarcam O-KAM SuperIPCam devices should assess exposure and prioritize verification of affected versions in their inventory. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify affected versions, assess exposure, and monitor for potential exploitation attempts.

Why it matters

CVE-2026-120337 allows remote exploitation of VStarcam O-KAM SuperIPCam devices, causing a use-after-free condition. Defenders should verify affected versions, assess exposure, and monitor for exploitation attempts.

• Verify affected versions of VStarcam O-KAM SuperIPCam devices
• Assess exposure of devices in inventory
• Monitor for potential exploitation attempts

Technical summary

The vulnerability is caused by a use-after-free condition in the FUN_005a2d44 function of the SuperIPCam.exe file, which is part of the P2P Session Teardown component. This can be exploited remotely. The issue affects VStarcam O-KAM SuperIPCam devices, specifically version 1.3.3.32. Defenders should prioritize verifying the affected versions and assessing exposure of VStarcam O-KAM SuperIPCam devices in their inventory. The exploit has been publicly disclosed, and although the vendor was contacted, no response was received.

Defensive priority

Defenders should prioritize verifying the affected versions and assessing exposure of VStarcam O-KAM SuperIPCam devices in their inventory.

Recommended defensive actions

• Verify VStarcam O-KAM SuperIPCam devices in inventory for version 1.3.3.32
• Assess exposure of affected devices
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description and CVSS score. However, the vendor's response and affected versions require further verification. Defenders should verify affected versions, assess exposure, and monitor for exploitation attempts. The vulnerability is caused by a use-after-free condition in the FUN_005a2d44 function of the SuperIPCam.exe file, which is part of the P2P Session Teardown component. This can be exploited remotely. Evidence is limited; further defensive review,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.