What is CVE-2026-120337 in VStarcam O-KAM?
VStarcam O-KAM SuperIPCam version 1.3.3.32 suffers from a security flaw tracked as CVE-2026-120337 with a CVSS score of 7.3. The vulnerability exists within the function FUN_005a2d44 of the file SuperIPCam.exe, specifically inside the P2P Session Teardown component.
This security defect has been documented in technical databases such as ActivityClientController.java security update and ActivityStarter.java security flaw references, highlighting the importance of keeping software components secure against memory corruption risks.
How does the vulnerability affect remote P2P sessions?
The flaw is triggered during the termination of peer-to-peer connections, leading to a use-after-free condition. Because the attack can be initiated remotely, unauthorized actors could leverage the publicly disclosed exploit against vulnerable installations.
The vendor was contacted early about this disclosure but has not responded in any way, leaving systems exposed without an official patch from the manufacturer.
How can I protect my systems against this flaw?
Users and administrators managing these cameras must implement defensive measures immediately to prevent potential network compromise. As part of standard security hygiene, reviewing the Rust zip library advisory can also offer helpful insight into handling critical flaws.
Follow these steps to secure your environment against potential exploitation:
- Isolate the affected VStarcam O-KAM SuperIPCam devices from the public internet using a secure firewall or VLAN.
- Disable remote P2P session access or unnecessary cloud relay features if they are not strictly required.
- Monitor network traffic for anomalous behavior targeting the device's management ports.
- Check periodically for any official vendor firmware updates or security advisories.