Cross-site request forgery (CSRF) vulnerability in cgi-bin/admin/usrgrp.cgi in AirLive POE2600HD POE250HD POE200HD OD-325HD OD-2025HD OD-2060HD POE100HD and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users.