CISA Advises on Cognex In‑Sight Risks: Mitigate Legacy Camera Vulnerabilities

CISA’s latest advisory on Cognex In‑Sight Explorer and In‑Sight camera firmware warns of a broad set of high‑severity, remotely exploitable weaknesses — including hard‑coded credentials, cleartext credential transport, replayable authentication, weak permissions on Windows hosts, and telnet/proprietary protocol flaws — that together raise the risk profile for manufacturers that still run legacy In‑Sight Explorer software or older In‑Sight camera firmware. (support.cognex.com)

Background​

Cognex In‑Sight vision systems have been a common fixture on factory floors for decades, used to automate inspection, alignment and identification tasks across discrete manufacturing and logistics operations. The product family spans embedded cameras and PC‑hosted tooling, notably the long‑running In‑Sight 2000/7000/8000/9000 series and the Windows‑hosted In‑Sight Explorer configuration tool. Cognex’s support materials confirm that multiple In‑Sight firmware branches and Explorer releases have coexisted for years, with newer product lines and an upgraded In‑Sight Vision Suite emerging more recently. (support.cognex.com) (support.cognex.com)
CISA’s advisory (published in September 2025) aggregates multiple CVE entries and assigns high CVSS scores (some recalculated using CVSS v4). The advisory frames the affected products as legacy In‑Sight Explorer–based systems and urges migration to more modern In‑Sight Vision Suite devices where feasible while also prescribing immediate network and operational mitigations.

---

Executive summary — What operators need to know now​

• Scope: Affected equipment includes In‑Sight 2000, 7000, 8000, 9000 series cameras and In‑Sight Explorer software, specifically older branches (the advisory lists versions 5.x up to and including 6.5.1 as affected).
• Severity: CISA lists multiple vulnerabilities with CVSS v3.1 base scores in the 7.7–8.8 range; when re‑scored using CVSS v4 some entries show base scores up to 8.6. The advisory highlights several attack‑chains that are exploitable from adjacent networks with low attack complexity.
• Primary risks: Credential theft and replay (allowing unauthorized access), unauthorized modification of device configuration (network settings, serial ports), denial‑of‑service via authentication mismanagement, local Windows file corruption due to weak installation permissions, and exposure of management protocols in cleartext.
• Immediate impact: An attacker who can reach the device’s management interfaces (telnet, proprietary TCP 1069, or physically adjacent network segments) could intercept credentials, bypass authentication using replayed encrypted passwords, change network or serial settings, or cause service outages.

Overview of affected products and versions​

Cognex maintains several firmware and software families in parallel. The advisory specifically calls out In‑Sight firmware families and Explorer releases that remain in production or fielded in legacy deployments:

• In‑Sight 2000 series — firmware versions 5.x through 6.5.1 (inclusive).
• In‑Sight 7000 series — firmware versions 5.x through 6.5.1 (inclusive).
• In‑Sight 8000 series — firmware versions 5.x through 6.5.1 (inclusive).
• In‑Sight 9000 series — firmware versions 5.x through 6.5.1 (inclusive).
• In‑Sight Explorer (Windows host tool) — versions 5.x through 6.5.1 (inclusive).

Cognex’s own support portal documents the many firmware branches and the product families for which those branches are relevant, reinforcing that older software/firmware branches are still in use on production floors. That long tail of supported versions complicates remediation for operations teams that must balance uptime against security. (support.cognex.com)

---

Technical breakdown — the meaningful vulnerabilities​

The advisory groups a set of related weaknesses into technical categories. Below is a distilled, actionable breakdown, paraphrasing the technical findings while retaining the advisory’s original risk framing.

Use of hard‑coded password (CWE‑259)​

• What it means: The vendor’s software package contains an embedded credential that can be read by an adjacent attacker without authentication. Once retrieved, that credential can decrypt session data or be reused against device management interfaces.
• Operational risk: Credential disclosure can permit lateral movement into the device and enable decryption of otherwise protected firmware upgrade traffic.

Cleartext transmission of sensitive information (CWE‑319)​

• What it means: Sensitive credentials are sent in the clear (or in an insufficiently protected form) during firmware upgrade and user management procedures on exposed ports, allowing interception by an adjacent actor.
• Operational risk: Eavesdropping on upgrade sessions yields privileged credentials and can be used to replace firmware or access device management functions.

Incorrect default permissions on Windows hosts (CWE‑276)​

• What it means: The In‑Sight Explorer installer creates a data folder on Windows with overly permissive ACLs, allowing any local user on the host to modify its content.
• Operational risk: A low‑privileged local user on a Windows engineering workstation (where Explorer is installed) could tamper with configuration or job data and potentially escalate to interfering with device communications or causing data corruption.

Improper restriction of excessive authentication attempts (CWE‑307)​

• What it means: Telnet management on port 23 is present and the service mishandles repeated authentication failures; the service can be driven to an unreachable state (DoS).
• Operational risk: Attackers can lock out management access and disrupt operations by intentionally making repeated failed login attempts.

Incorrect permission assignment for critical resources (CWE‑732)​

• What it means: Privileged functions available over telnet or management protocols can be invoked by users with insufficient authorization; SetSystemConfig and SetSerialPort functions are mis‑restricted.
• Operational risk: Attackers or misconfigured integrators could change network and serial settings remotely, enabling persistent misconfiguration or network segmentation bypass.

Cleartext proprietary protocol on TCP 1069 (CWE‑319)​

• What it means: The device implements a proprietary management protocol on TCP port 1069 that transmits usernames and passwords in an unencrypted form.
• Operational risk: Adjacent network adversaries can passively capture management credentials and use them to authenticate to the device.

Authentication bypass by capture‑replay (CWE‑294)​

• What it means: Multiple protocols share a scheme that encrypts the password but reuses the same encryption key across sessions; attackers can capture encrypted passwords and replay them to authenticate.
• Operational risk: Passive interception followed by replay leads to unauthorized access without the attacker ever learning the cleartext password.

Client‑side enforcement of server‑side security (CWE‑602)​

• What it means: Management decisions are enforced on the client end (In‑Sight Explorer) rather than the device, allowing a manipulated client to perform privileged operations the server should deny.
• Operational risk: Compromised or modified client software (or a malicious integration tool) can carry out administrative operations that the device should independently control.

---

What to verify immediately (technical checklist)​

• Inventory: Confirm which In‑Sight cameras and In‑Sight Explorer installations are present on your networks and capture their firmware/software versions. Include build numbers where available. Cognex release notes and the support portal can help match models to supported firmware families. (support.cognex.com)
• Network exposure: Identify any cameras or management hosts reachable from the corporate/business network or from adjacent subnets; pay special attention to devices with telnet (23) or proprietary TCP 1069 open.
• Windows host hardening: On engineering and workstation systems running In‑Sight Explorer, inspect the application data folders’ ACLs and apply least‑privilege file permissions.
• Remote access paths: Where remote access exists, confirm whether VPNs, jump boxes, or RDP/SSH gateways are in use and ensure those control points are current and monitored. CISA reiterates that VPNs are preferable to exposing control ports directly, but are not a panacea.

---

Mitigations and remediation strategy​

CISA’s advisory recommends migration to newer In‑Sight Vision Suite devices when practical (for example, Cognex’s In‑Sight 2800, 3800, 8900 series are cited as next‑generation alternatives). Where migration is not immediately possible, CISA prescribes network and operational mitigations that are proven defensive measures for ICS/OT devices. Cognex’s support and release documentation can also guide which firmware and Vision Suite releases include improved security features (secure WebHMI/WebAPI, audit logging, role‑based permissions) and should be prioritized for long‑term upgrades.
Recommended short‑term actions (ordered by priority)

• Isolate: Move vulnerable devices to an isolated VLAN or physically separate network that is not reachable from the internet or broad business networks. Use allowlists to control which engineering hosts may access those VLANs.
• Block management ports at network edges: Deny direct access to telnet (23), TCP 1069, and other management interfaces on firewalls unless specifically required and inspected. Replace telnet with secure management channels where possible.
• Enforce least privilege on Windows hosts: Fix overly permissive ACLs created by In‑Sight Explorer installers. Audit local accounts and remove non‑essential users from workstations used for device management.
• Monitor for credential exfiltration: Enable packet capture/IDS signatures that detect cleartext credential exchanges and unusual PUT/POST operations to management endpoints. Look for repeated authentication attempts and replay‑like patterns.
• Use secure remote access: When remote access is required, route through hardened bastion hosts or segmented VPNs with multi‑factor authentication; keep VPN concentrators and jump hosts patched. CISA cautions that VPNs are only as secure as the connected devices.
• Vendor updates and migration: Where possible, plan migration to In‑Sight Vision Suite or to firmware builds that explicitly address the identified weaknesses. Cognex’s modern In‑Sight Vision Suite releases contain features such as secure WebHMI and improved audit logging; these are useful long‑term mitigations. (support.cognex.com)

---

Detection and forensics guidance​

• Network detection: Look for connections to TCP 1069 and telnet sessions originating from unexpected hosts; capture full packet logs for any telnet/1069 traffic for retrospective analysis. If you observe repeated failures followed by service unavailability, treat it as possible DoS via authentication mismanagement.
• Credential exposure: If firmware upgrade traffic or user management transactions have occurred without TLS (or over a proprietary cleartext channel), treat exposed credentials as compromised and rotate them through whatever account recovery procedures the product supports.
• Host compromise signs: On Windows engineering hosts, watch for unexpected modification of the In‑Sight Explorer job/data folders or for unsigned binaries writing to those directories (possible tampering leveraged by weak ACLs).

---

Why this matters for Windows administrators and OT/IT convergence teams​

Modern ICS/OT environments are frequently managed by Windows workstations running vendor tools such as In‑Sight Explorer. A compromise path that begins with weak Windows host ACLs or with client‑side trust assumptions can quickly translate into operational impacts on the plant floor. CISA’s advisory directly calls out that some of the vulnerabilities permit escalation and configuration changes from accounts that should not have such privileges — a classic example of IT‑to‑OT pivoting. Past CISA advisories and vendor guidance have repeatedly emphasized network segmentation, hardened management hosts, and strict patching policies as the most reliable compensations when vendor patches are not immediately available. (cisa.gov)
Cognex’s own product literature shows that newer In‑Sight families and In‑Sight Vision Suite releases offer enhanced security features (secure WebHMI/WebAPI, role separation and audit logging), which underscores the practical advantage of planning a migration path for cameras and tooling that remain on legacy stacks. (support.cognex.com)

---

Validation and verifiability of technical claims​

• The advisory supplied to operators lists specific CVE identifiers and both CVSS v3.1 and v4 vector strings for each entry; these are the central technical claims. Operators should cross‑check those CVE identifiers in public vulnerability feeds (NVD/CVE.org) and with Cognex’s PSIRT bulletins. At the time the advisory was published, operators should treat the CISA advisory as authoritative for remediation priorities while seeking vendor firmware notices for definitive patch timelines.
• Where CVE or NVD entries lag vendor or CISA notices, that is not unusual — especially where vendor coordination and embargoes precede public posting. If independent CVE records for any of the listed identifiers are not yet populated in third‑party aggregators, flag them as “pending external indexing” and rely on the advisory’s technical descriptions until canonical entries appear.

---

Practical remediation timeline (recommended)​

• Within 24–72 hours
• Block telnet (port 23) and TCP 1069 at firewall boundaries for all non‑essential flows. Isolate devices from any internet‑facing subnets.
• Identify and inventory In‑Sight devices and In‑Sight Explorer installations, capturing model, firmware, and build numbers. (support.cognex.com)
• Within 1–2 weeks
• Harden Windows engineering hosts: correct ACLs, remove unnecessary local users, enable endpoint monitoring, and check for unauthorized changes to In‑Sight data folders.
• Implement network segmentation controls (VLANs, ACLs) to separate OT management traffic from general business networks.
• Within 30–90 days
• Plan and test firmware updates or migration to newer In‑Sight Vision Suite devices that include secure management features. Coordinate with Cognex support for staged upgrade paths to avoid production disruptions. (support.cognex.com)
• Deploy monitoring and IDS/IPS rules tuned for the protocol and authentication anomalies described in the advisory.

---

Risks, trade‑offs, and operational realities​

• Migration vs. uptime: For many manufacturers, cameras are integral to production lines with limited maintenance windows. Migrating firmware or swapping hardware will require planned downtime and regression testing; expect operations teams to resist large‑scale changes without validated rollback procedures. Nevertheless, the presence of replayable authentication and cleartext credential transport increases the urgency of a long‑term migration plan.
• Compensating controls are imperfect: Firewalls, VPNs and segmentation reduce exposure but do not fix protocol weaknesses. CISA explicitly warns that a VPN’s security is only as strong as the endpoints that connect to it. The advisory therefore rightly demands both network hardening and local host remediation.
• Windows‑level vulnerabilities amplify OT risk: The weak default permissions on Windows hosts are a concrete example of how IT misconfigurations can facilitate OT compromise. Organizations must include Windows administrators in OT vulnerability triage and remediation planning.

---

Recommended long‑term program changes​

• Replace legacy In‑Sight Explorer–based systems with In‑Sight Vision Suite–capable hardware where operationally feasible; new Vision Suite releases incorporate secure web APIs, role separation, and audit logging that mitigate many of the issues raised. (support.cognex.com)
• Establish a vendor firmware‑tracking program that ties device inventories to expected firmware levels and automated patch/upgrade reminders. Integrate these feeds into the CMDB or asset management tooling that IT/OT share.
• Institute least‑privilege and application‑whitelisting policies for engineering workstations, with enforced ACL baselines and periodic auditing to prevent permissive folder creation or tampering.
• Adopt an incident response runbook specific to ICS camera and vision systems that includes packet capture, offline firmware preservation, and coordinated vendor escalation channels.

---

Conclusion​

CISA’s advisory on Cognex In‑Sight Explorer and In‑Sight camera firmware is a compact but urgent reminder that legacy device management interfaces and long‑running firmware branches remain a persistent attack surface in manufacturing environments. The combination of cleartext credential transport, replayable authentication, management protocols on unencrypted channels, and weak Windows host permissions forms a credible attack surface that can be exploited from adjacent networks with relatively low complexity. For operators, the defensible path runs through three parallel tracks: (1) immediate containment and hardening (isolation, blocking management ports, host ACL fixes), (2) medium‑term detection and monitoring (IDS rules, credential rotation, logging), and (3) long‑term remediation (firmware upgrades and migration to In‑Sight Vision Suite families). Cognex’s product documentation and support channels can assist with firmware and migration planning, and CISA’s advisory supplies actionable priority mitigations for defenders to apply while upgrades are scheduled. (support.cognex.com)
Organizations should treat the constraints of production uptime seriously, but not as an excuse to defer mitigations that materially reduce exposure. The balance of operations and security requires explicit cross‑team planning and a documented, testable upgrade path for vision systems that perform critical production tasks.

---

(If coordinating a remediation, prioritize (a) immediate network isolation, (b) host ACL corrections on Windows engineering machines, and (c) a test upgrade path to a supported In‑Sight Vision Suite release that provides secure management features.)

---

Source: CISA Cognex In-Sight Explorer and In-Sight Camera Firmware | CISA