Unauthenticated RTSP Access in FLIR AX8 Thermal Camera

Executive Summary

This vulnerability in FLIR AX8 Thermal Camera firmware version 1.32.16 allows remote attackers to access the live video stream without any authentication. Attackers can connect directly to the RTSP stream using tools like VLC or FFmpeg to view and record thermal camera footage. The vulnerability exposes sensitive visual data by permitting unauthorized access to the thermal sensor's live video stream. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by exposing sensitive thermal camera footage to unauthorized parties. This can compromise security monitoring and operational integrity, as attackers can view and record live video streams without credentials. It may also allow attackers to disrupt the video stream by freezing it via specific POST requests, potentially affecting critical equipment monitoring. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the RTSP stream of the FLIR AX8 Thermal Camera without authentication using tools like VLC, FFmpeg, or FFplay. Proof-of-concept commands include connecting directly to the RTSP stream URL to view or record the live thermal video stream. Additionally, an HTTP request can be made to download a snapshot image from the device. These methods verify if the camera allows unauthenticated access to its video streams. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting network access to the FLIR AX8 Thermal Camera to trusted users only, such as by placing the device behind a firewall or VPN. Monitoring and blocking unauthorized RTSP connections can help prevent exploitation. Applying any available firmware patches or updates released by FLIR Systems is critical once they are available. Additionally, following FLIR's cybersecurity hardening guides and bulletins is recommended to enhance device security. [2]

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated access to live video streams from the FLIR AX8 Thermal Camera, exposing sensitive visual data. This unauthorized disclosure of potentially sensitive information could lead to non-compliance with data protection regulations such as GDPR or HIPAA, which require protection of personal and sensitive data. However, specific impacts on compliance with these standards are not detailed in the provided resources. [1, 2]

Useful 0 Not Useful 0