Sergey Zelensky

The issue is related to insufficient authentication in the Telnet service of the Wi-Fi camera's firmware, allowing a remote attacker to gain unauthorized access to RTSP and ONFIV services. This access enables the attacker to watch live streams from the camera, change camera settings, rotate the camera, restart it, or reset it to factory settings.

A Cleartext Transmission issue allows an attacker to intercept and modify video data from the camera, as it is transmitted in an unencrypted form. The attacker can also modify responses from NTP and RTSP servers, forcing the camera to use the changed values. This issue is related to the lack of protection for transmitted data.

The issue is related to the Telnet service of the affected cameras, which allows a remote attacker to gain full control of the device using a high-privileged account. This is due to a system account having a default and static password that cannot be changed via standard functionality. The Telnet service itself cannot be disabled.

The issue allows a remote attacker to inject malicious JavaScript payload into a victim's browser, potentially stealing administrator cookies, influencing HTML content, and performing phishing attacks. This affects over 3000 organizations across various sectors. The vulnerability is related to the lack of protection for the web page structure, allowing an attacker to execute arbitrary code.