| Título | Eyeplus EYEPLUS_DEV 57.0.0.0308 Information Disclosure |
|---|
| Descripción | Unauthenticated HTTP GET to the p2pcam service on TCP port 8001 returns a JPEG snapshot of the camera current video frame without authentication.
Endpoint: GET http://TARGET:8001/snapshot
Service: p2pcam HTTP API on port 8001 (distinct from ONVIF on port 80)
ONVIF GetDeviceInformation reports: Manufacturer=EYEPLUS, Model=EYEPLUS_DEV, Firmware=57.0.0.0308, HardwareID=aj_ipc_hc2_001 (HC1703L family).
Note on product naming: EYEPLUS_DEV is the ONVIF model string (not a retail SKU). The same OEM platform is sold under white-label names such as YCC365 Plus 1620P WiFi IP Camera (AliExpress item 1005006666714240).
ONVIF GetSnapshotUri on port 80 (/onvif/snapshot) did not return a usable JPEG on the tested device. Port 8001 /snapshot returns Content-Type: image/jpeg with a valid JPEG body.
Impact: LAN attacker captures the current camera frame without an RTSP session or credentials.
CWE-306, CWE-200. CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (6.5 Medium)
PoC:
curl -s -D - --max-time 10 "http://TARGET:8001/snapshot" -o snapshot.jpg
References:
https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-8001-Unauth-Snapshot-Disclosure.md
https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-GetUsers-Unauth-Plaintext-Password.md
https://nvd.nist.gov/vuln/detail/CVE-2025-14748
https://nvd.nist.gov/vuln/detail/CVE-2025-14749
https://www.ycc365plus.com/en
https://ko.aliexpress.com/item/1005006666714240.html |
|---|
| Fuente | ⚠️ https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-8001-Unauth-Snapshot-Disclosure.md |
|---|
| Usuario | Janger (UID 97645) |
|---|
| Sumisión | 2026-08-09 17:00 (hace 2 meses) |
|---|
| Moderación | 2026-09-27 11:26 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 410858 [Eyeplus 57.0.0.0308 p2pcam Service /snapshot divulgación de información] |
|---|
| Puntos | 20 |
|---|