CVE-2019-20464
By initiating communication on the RTSP port, an attacker can obtain access to the video feed without authenticating.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. By default, a mobile application is used to stream over UDP. However, the device offers many more services that also enable streaming. Although the service used by the mobile application requires a password, the other streaming services do not. By initiating communication on the RTSP port, an attacker can obtain access to the video feed without authenticating.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.67% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- sannce/smart hd wifi security camera ean 2 950004 595317 firmware
- Source
- cve@mitre.org
References
- http://seclists.org/fulldisclosure/2024/Jul/14
- https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/14
- https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.