External risk intelligence

Ezviz Camera Unauthenticated RTSP Stream Access.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-42531

This device is an internet-connected camera designed for remote video monitoring. Such devices are typically deployed with public-facing network accessibility to facilitate remote viewing, and the vulnerability specifically involves unauthorized access to RTSP streams via network packets.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security vulnerability in Ezviz Internet PT Camera models that could allow unauthorized access to live video streams. The issue arises from the ability to craft specific network packets to redirect the camera's feed. While the vendor acknowledges the potential for protocol communication, they assert that actual video or audio data cannot be obtained, thus mitigating the risk from their perspective.

Unauthorized access to camera video streams.
Confirms the importance of vendor risk assessment.
Focus on verifying relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target an internet-connected camera from anywhere on the network. By sending specially crafted network packets, they can trick the camera into revealing its live video feed without needing any login credentials. This could allow an attacker to view sensitive information or locations remotely.

Unauthenticated network access required.
Craft specific RTSP packets to redirect feed.
Unauthorized live video stream access.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could potentially access the live video stream from an internet-connected Ezviz camera by sending specially crafted RTSP packets. This could occur when the camera is accessible over a network.

Live video stream access.
Crafted RTSP packets exploit URL redirection.
Unauthorized video surveillance.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this vulnerability, infrastructure and network security teams are likely responsible for managing and securing internet-connected cameras. The initial step involves identifying all instances of the affected camera model within the environment, determining their network exposure, and assessing their criticality to operations. This will allow for prioritization and planning of remediation efforts, which may include coordination with the vendor.

Identify camera instances and exposure.
Confirm reachability and criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ezviz Internet PT Camera CS-CV246?

This is an internet-connected device designed for remote video surveillance and monitoring. Users rely on these cameras to view live footage from home or work environments over the internet, often using mobile apps or browser interfaces that rely on standard streaming protocols to transmit video and audio data.

What does CVE-2024-42531 mean for my camera?

This CVE describes a weakness classified as Improper Input Validation (CWE-20). In simple terms, the camera may fail to properly check or restrict the network packets it receives. This vulnerability specifically involves the Real-Time Streaming Protocol (RTSP), which is commonly used to manage the delivery of live media, potentially allowing unauthorized parties to interact with the device's streaming functions.

How does an attacker trigger this vulnerability?

An attacker triggers this issue by sending specifically crafted RTSP network packets to the camera. It is important to note that sending these packets does not automatically grant full control over the device; the vendor maintains that while the protocol communication can be initiated, the actual video or audio data may remain inaccessible, depending on the camera's internal processing of the malformed requests.

Is my Ezviz camera at risk?

According to Halo Surface Signal, this device is considered highly relevant because it is an internet-connected camera, which is frequently deployed with public-facing network access to support remote viewing. If your camera is directly connected to the internet rather than sitting behind a restrictive firewall or VPN, it is more reachable by potential network-based attackers.

Do I need to take action if I use this camera?

Yes. Start by creating an inventory of any Ezviz units in your network to understand where they are deployed. Determine if they are accessible from the internet or limited to internal segments. Once identified, monitor for official vendor guidance or security updates regarding this specific model to determine if further configuration changes or firmware updates are necessary to secure your device.

References

github.com/Anonymous120386/Anonymous

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.