Summary
Zosi C519M V4.2.8.823C01450BA uses hardcoded, unchangeable credentials for RTSP authentication. An attacker with network access may use those credentials to access the camera's RTSP video stream and view footage without authorization.
Affected context
The vulnerability occurs in camera deployments where the RTSP service relies on credentials embedded in the application or device firmware and those credentials cannot be changed by administrators. It becomes risky when the RTSP interface is reachable by an attacker through the local network, an exposed management segment, or another path providing network access.
Exploit preconditions
- Attack surface: Network-accessible RTSP service
- Required access: Network connectivity to the camera's RTSP interface
- Trigger point: RTSP authentication
- Why exploitation is possible: The service accepts hardcoded credentials that are fixed and therefore available to parties who obtain or discover them
Why this happens
The underlying issue is an access-control design that relies on credentials embedded in the product rather than administrator-controlled authentication secrets. Because the credentials are unchangeable, users cannot rotate or revoke them, allowing a party with network access to authenticate to the RTSP service. This behavior maps to CWE-284: Improper Access Control, because access to a protected video resource is granted using a weak and non-revocable authorization mechanism.
Potential impact
- An attacker may view live camera footage without authorization
- Recorded or streamed video may be exposed to unauthorized parties
- Privacy and physical-security monitoring may be weakened
- Attackers could use accessible camera streams to gather information about people, facilities, or operations
General mitigation guidance
Mitigation generally focuses on eliminating fixed shared credentials and reducing exposure of streaming services.
Common defensive patterns include:
- Using unique, administrator-controlled credentials for each device
- Providing supported credential rotation and revocation mechanisms
- Restricting RTSP access to trusted networks and authorized clients
- Avoiding direct exposure of camera streaming interfaces to untrusted networks
- Applying network segmentation and least-privilege firewall policies
- Disabling unused streaming protocols or services where operationally feasible
- Protecting management and video traffic with appropriate authentication and transport controls
How teams detect issues like this
Organizations can look for this issue through:
- Firmware and application reviews for embedded usernames, passwords, or authentication constants
- Static analysis searches for hardcoded secrets and fixed RTSP authentication values
- Code review signals showing credentials that cannot be configured, rotated, or revoked
- Network scans identifying RTSP services reachable beyond approved camera-management segments
- Authentication-log reviews for unexpected RTSP access or repeated use of shared credentials
- Policy enforcement requiring unique device credentials and documented streaming-service exposure
