Hardcoded RTSP Credentials in Zosi C519M Camera

Executive Summary

This vulnerability is an Incorrect Access Control issue in the Zosi C519M V4.2.8.823C01450BA IP camera. The device contains hardcoded credentials (admin:admin) in its RTSP authentication mechanism, allowing unauthorized access to live video streams.

Useful 0 Not Useful 0

Detection Guidance

Check if TCP port 554 is open and accessible on the camera by using commands like 'nmap -p 554 <camera_IP>' or 'telnet <camera_IP> 554'. Verify if the RTSP stream can be accessed using default credentials 'admin:admin' via tools like VLC or FFmpeg with 'rtsp://admin:admin@<camera_IP>:554/stream1'.

Inspect the camera's firmware file '/app/config.xml' for hardcoded credentials if physical access is available. Look for entries like '<username>admin</username>' and '<password>admin</password>'.

Useful 0 Not Useful 0

Impact Analysis

An attacker with network access can exploit this to view camera footage without authentication. This compromises privacy and security by allowing unauthorized surveillance of the affected area.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with privacy regulations like GDPR or HIPAA by exposing sensitive video data without proper access controls, potentially violating data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Block inbound access to TCP port 554 at the network perimeter using a firewall. Isolate the camera on a segmented VLAN to restrict access. Use a VPN to limit exposure to trusted users only.

Disable RTSP access if not required. Monitor network traffic for unauthorized connections to port 554. Contact the vendor for firmware updates or workarounds.

Useful 0 Not Useful 0