जमा करें #919784: Eyeplus EYEPLUS_DEV 57.0.0.0308 Information Disclosure

Unauthenticated HTTP GET to the p2pcam service on TCP port 8001 returns a JPEG snapshot of the camera current video frame without authentication.

Endpoint: GET http://TARGET:8001/snapshot
Service: p2pcam HTTP API on port 8001 (distinct from ONVIF on port 80)

ONVIF GetDeviceInformation reports: Manufacturer=EYEPLUS, Model=EYEPLUS_DEV, Firmware=57.0.0.0308, HardwareID=aj_ipc_hc2_001 (HC1703L family).

Note on product naming: EYEPLUS_DEV is the ONVIF model string (not a retail SKU). The same OEM platform is sold under white-label names such as YCC365 Plus 1620P WiFi IP Camera (AliExpress item 1005006666714240).

ONVIF GetSnapshotUri on port 80 (/onvif/snapshot) did not return a usable JPEG on the tested device. Port 8001 /snapshot returns Content-Type: image/jpeg with a valid JPEG body.

Impact: LAN attacker captures the current camera frame without an RTSP session or credentials.

CWE-306, CWE-200. CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (6.5 Medium)

PoC:
curl -s -D - --max-time 10 "http://TARGET:8001/snapshot" -o snapshot.jpg

References:
https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-8001-Unauth-Snapshot-Disclosure.md
https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-GetUsers-Unauth-Plaintext-Password.md
https://nvd.nist.gov/vuln/detail/CVE-2025-14748
https://nvd.nist.gov/vuln/detail/CVE-2025-14749
https://www.ycc365plus.com/en
https://ko.aliexpress.com/item/1005006666714240.html

• स्रोत: ⚠️ https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-8001-Unauth-Snapshot-Disclosure.md
• उपयोगकर्ता: Janger (UID 97645)
• सबमिशन: 09/08/2026 05:00 PM (2 महीनों पहले)
• संयम: 27/09/2026 11:26 AM (2 months later)
• स्थिति: स्वीकृत
• VulDB प्रविष्टि: 410858 [Eyeplus 57.0.0.0308 p2pcam Service /snapshot सूचना का प्रकटीकरण]
• अंक: 20