Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability affects MERCURY MIPC252W IP cameras, allowing an attacker to bypass authentication after an initial successful login. The camera fails to properly validate subsequent requests, enabling unauthorized control commands through reused session information. This is concerning because it can lead to unauthorized access to video streams and camera functions.
- Allows unauthenticated commands.
- Impacts remote camera control.
- Accessible from the internet.
Attack Path
How an attacker could exploit the issue
An attacker with network access to a vulnerable MERCURY MIPC252W IP camera can exploit this flaw to gain unauthorized control. They can bypass proper authentication after an initial successful login by reusing session information, allowing them to issue commands like SETUP, PLAY, or TEARDOWN without valid credentials. This could lead to unauthorized video access or disruption of the camera's functions.
- Network access required.
- Targets RTSP service.
- Initial valid session needed.
Live Threat
Current exploitation, exposure, and threat context
Attackers may find this vulnerability appealing due to its critical severity and the potential for unauthenticated remote access to IP cameras, which are often exposed online for surveillance. The ease of exploiting the improper authentication in the RTSP service without needing to compute a valid digest response makes it an attractive target for unauthorized control.
- No known public exploits exist.
- The vulnerability is unauthenticated and remotely exploitable.
- IP cameras are frequently internet-facing.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize isolating or taking offline any MERCURY MIPC252W IP cameras running firmware version 1.0.5 Build 230306. This vulnerability allows unauthenticated network attackers to issue unauthorized RTSP commands, potentially leading to unauthorized access and control of the camera's video stream.
- Block RTSP traffic to affected cameras.
- Monitor network for unauthorized RTSP commands.
- Update firmware to a non-vulnerable version.
