Missing Authentication for Critical Function (CWE-306)
The LSC Smart Connect Indoor IP Camera V7.6.32 is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera's feed, potentially compromising user privacy and security. No credentials or special permissions are required, and access can be gained remotely over the network.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD published the first details for CVE-2024-51362
Feedly found the first article mentioning CVE-2024-51362. See article
Feedly estimated the CVSS score as HIGH
CVE-2024-51362 is a critical vulnerability in the LSC Smart Connect Indoor IP Camera, stemming from an exposed RTSP port (8554) that lacks authentication, allowing unauthorized access to live video feeds. This vulnerability poses significant privacy and security risks, as it can be exploited for malicious surveillance purposes. The article does not provide information on CVSS scores, proof-of-concept exploits, mitigations, detections, patches, or downstream impacts on third-party vendors. See article
EPSS Score was set to: 0.04% (Percentile: 10%)
A CVSS base score of 6.5 has been assigned.