Ningyuanda TC155 IP Camera RTSP Stream Unauthenticated Access Vulnerability

A vulnerability exists in the Ningyuanda TC155 IP camera, specifically in the RTSP live video stream endpoint, within firmware version 57.0.2.0. This vulnerability allows improper authentication, enabling unauthorized access to the camera's live video feed. The issue can be exploited by anyone on the same local network, raising significant privacy concerns as it allows for covert surveillance without detection.

Impact

Exploitation of this vulnerability allows for unauthorized access to the camera's live video feed, which can be captured and recorded. This not only invades privacy but also enables unauthorized surveillance of physical spaces.

Reproduction

To reproduce this vulnerability, connect to the same local area network as the TC155 IP camera. Use a network scanning tool to identify the camera's IP address. Once the camera IP is known, confirm that the RTSP port (554) is open and accessible. After verifying the port exposure, attempt to stream video from the RTSP endpoint using a media player that supports RTSP, such as FFplay. The live video stream will be displayed without any authentication, demonstrating the vulnerability.