FLIR Brickstream 3D+ Unauthenticated RTSP Stream Access Vulnerability

A vulnerability in the FLIR Brickstream 3D+ firmware version 2.1.742.1842 allows remote attackers to access live video streams without authentication. This issue arises from the sensor's RTSP stream being exposed, enabling unauthorized retrieval of video images through direct access to various image endpoints.

Impact

Exploitation of this vulnerability leads to unauthorized access to live video streams, allowing for real-time surveillance without the knowledge or consent of those being observed.

Reproduction

The vulnerability can be reproduced by sending a request to the exposed image endpoints on the device. This can be automated with a script that downloads images from these endpoints, which can then be compiled into a video using a tool like ffmpeg.