BEWARD N100 IP Camera Unauthenticated RTSP Stream Disclosure (ZSL-2019-5509)

Key Information about the Vulnerability Vulnerability Title: BEWARD N100 H.264 VGA IP Camera M2.1.6 Unauthenticated RTSP Stream Disclosure Advisory ID: ZSL-2019-5509 Type: Remote/Local Impact: Exposure of System Information, Exposure of Sensitive Information Risk: (3/5) Release Date: 04.02.2019 Overview The N100 compact color IP camera, featuring support for a more efficient compression format, is optimized for low-speed networks, enabling real-time image transmission over the network with minimal delays. The camera supports switching between broadcast modes, and in the event of a communication break with remote file storage, it can continue recording to a microSDHC memory card. The N100 is easy to install and configure, and includes all necessary tools for setting up low-cost professional video surveillance systems. Description The BEWARD N100 camera is vulnerable to unauthenticated and unauthorized access to its live RTSP video stream. Vendor Beward R&D Co., Ltd - https://www.beward.net Affected Versions M2.1.6.04C014 Test Platforms Boa/0.94.14rc21 Farady ARM Linux 2.6 Vendor Status [26.01.2019] Vulnerability discovered. [28.11.2018] Vendor contacted. [03.02.2019] No response from the vendor. [04.02.2019] Public security advisory released. PoC beward_rtsp.txt Acknowledgments Vulnerability discovered by Gjoko Krstic - References [1] https://www.exploit-db.com/exploits/46317 [2] https://packetstormsecurity.com/files/151528 [3] https://exchange.xforce.ibmcloud.com/vulnerabilities/156597 Changelog [04.02.2019] - Initial release [10.02.2019] - Added references [1], [2], and [3]

Goal Reached Thanks to every supporter — we hit 100%!

BEWARD N100 IP Camera Unauthenticated RTSP Stream Disclosure (ZSL-2019-5509)