Critical One-Click RCE Vulnerability in IDIS Cloud Manager Exposes Surveillance Systems A severe vulnerability in IDIS Cloud Manager (ICM) Viewer (CVE-2025-12556, CVSS 8.7) allows attackers to achieve remote code execution (RCE) with a single click, compromising Windows systems used to monitor IDIS IP cameras. The flaw, discovered by security researchers, stems from improper input validation in the ICM Viewer’s WebSocket communication, enabling malicious command-line flag injection. ### How the Attack Works The ICM Viewer, a Windows application for accessing live and recorded surveillance feeds via IDIS’s cloud platform, relies on a local service (CWGService.exe) listening on ws://localhost:16140. When a user clicks "Run Viewer" in the web dashboard, the service launches WCMViewer.exe with parameters including a URL passed without sufficient sanitization. Attackers can exploit this by: 1. Tricking a user into visiting a malicious webpage containing JavaScript that opens a WebSocket connection to localhost:16140. 2. Injecting malicious Chromium command-line flags (e.g., `--utility-cmd-prefix`) into the viewer’s launch parameters, as WCMViewer.exe is built on the Chromium Embedded Framework (CEF). 3. Executing arbitrary code on the victim’s system, as demonstrated by researchers who spawned notepad.exe as a proof of concept. ### Impact & Risks - One-click RCE: No user interaction beyond clicking a link is required. - Full system compromise: Attackers gain control of the Windows host managing IDIS surveillance, potentially enabling lateral movement within networks. - Exposure of critical infrastructure: Compromised systems could provide access to other surveillance assets or sensitive endpoints. ### Root Causes The vulnerability arises from multiple design flaws: - No origin validation (missing CORS checks on the local WebSocket). - Hard-coded encryption key for WebSocket messages. - Unsanitized command-line arguments passed to WCMViewer.exe. - Insufficient parameter validation before CEF execution. ### Mitigation & Response IDIS has released ICM Viewer version 1.7.1 to address the issue, urging customers to upgrade immediately or uninstall the software if patching is not feasible. The Cybersecurity and Infrastructure Security Agency (CISA) has also highlighted the risk, emphasizing the need for organizations to review exposed surveillance management systems and harden local services. The flaw underscores the risks of cloud-connected security tools with inadequate input validation, particularly in critical infrastructure environments.