Cooper Young

The RTSP service contains a null pointer dereference issue, which occurs when a program attempts to read or write to a memory address that is null, leading to a crash. An attacker on the local network can send specially crafted requests to the service, causing it to dereference an invalid pointer. This results in a service crash and device reboot, disrupting live video streaming and creating a temporary denial-of-service condition.

A heap-based buffer overflow exists in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, leading to out-of-bounds heap writes. This can crash the RTSP service and trigger a device reboot, causing a temporary denial-of-service condition.

A heap-based buffer overflow occurs in the HTTP POST body parsing logic due to insufficient boundary validation and missing validation of remaining buffer capacity after dynamic allocation when handling externally supplied HTTP input. An attacker on the same network segment can trigger heap memory corruption by sending crafted payloads that cause write operations beyond the allocated buffer boundaries. Successful exploitation can lead to a Denial-of-Service (DoS) condition, causing the device process to crash or become unresponsive, or potentially enable remote code execution (RCE).