CVE-2026-51977

This CVE exposes an extractable RSA private key in a consumer IoT camera (Trueview), rated CVSS 9.1 but with an EPSS score of only 0.00149. The apparent paradox — critical severity but low exploitation probability — dissolves when you examine the device category rather than treating this as a generic vulnerability. The low EPSS appears to reward physical proximity as a natural barrier. But security cameras are deployed exactly where proximate access is trivial for relevant threat actors: living rooms, nurseries, business entrances. The "physically proximate attacker" isn't an abstract threat model — it's the repair technician, the houseguest, the employee, the domestic adversary. For a security camera, proximity isn't a barrier; it's the default operating condition. More critically, the RSA private key vector isn't a patchable software bug — it's an architectural failure. Once extracted, this key becomes a permanent credential enabling certificate cloning, TLS impersonation across the device's network communications, and persistent access that survives firmware updates. The CVSS temporal metrics treat proximity as a gate that might close; the actual exploit geometry treats it as a one-time unlock for a durable capability. This vulnerability class has recurred in IoT cameras for over fifteen years — from early netcams through baby monitors to today's pan-tilt cameras — not because manufacturers keep making novel mistakes, but because the economic incentives that produce hardcoded keys have never changed. Secure key provisioning at scale requires infrastructure small manufacturers lack, and the market has never meaningfully penalized devices with these flaws. The ghost key problem compounds this: the extracted private key persists in firmware repositories, archived production images, and OEM downstream variants that may never be patched. Once documented in security literature, exploitation probability doesn't decay with patching — it becomes a permanent capability deployable against any device in that family regardless of firmware version. Defenders should treat this as a hardware-bound compromise: the device cannot be remediated through firmware updates alone. Assume that any Trueview camera with this vulnerability, or its OEM derivatives, will emit a certificate chain that remains valid indefinitely. Network segmentation is the primary mitigation — treat the camera as an untrusted network endpoint with egress to your trusted subnet, not as a security device you can trust. If certificate-based authentication is used for ONVIF or cloud connectivity, those trust relationships should be audited immediately.

Reviewed through automated stages and approved by a human before publication.