Submeter #919784: Eyeplus EYEPLUS_DEV 57.0.0.0308 Information Disclosure

Unauthenticated HTTP GET to the p2pcam service on TCP port 8001 returns a JPEG snapshot of the camera current video frame without authentication.

Endpoint: GET http://TARGET:8001/snapshot
Service: p2pcam HTTP API on port 8001 (distinct from ONVIF on port 80)

ONVIF GetDeviceInformation reports: Manufacturer=EYEPLUS, Model=EYEPLUS_DEV, Firmware=57.0.0.0308, HardwareID=aj_ipc_hc2_001 (HC1703L family).

Note on product naming: EYEPLUS_DEV is the ONVIF model string (not a retail SKU). The same OEM platform is sold under white-label names such as YCC365 Plus 1620P WiFi IP Camera (AliExpress item 1005006666714240).

ONVIF GetSnapshotUri on port 80 (/onvif/snapshot) did not return a usable JPEG on the tested device. Port 8001 /snapshot returns Content-Type: image/jpeg with a valid JPEG body.

Impact: LAN attacker captures the current camera frame without an RTSP session or credentials.

CWE-306, CWE-200. CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (6.5 Medium)

PoC:
curl -s -D - --max-time 10 "http://TARGET:8001/snapshot" -o snapshot.jpg

References:
https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-8001-Unauth-Snapshot-Disclosure.md
https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-GetUsers-Unauth-Plaintext-Password.md
https://nvd.nist.gov/vuln/detail/CVE-2025-14748
https://nvd.nist.gov/vuln/detail/CVE-2025-14749
https://www.ycc365plus.com/en
https://ko.aliexpress.com/item/1005006666714240.html

• Fonte: ⚠️ https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-8001-Unauth-Snapshot-Disclosure.md
• Utilizador: Janger (UID 97645)
• Submissão: 09/08/2026 17h00 (há 2 meses)
• Moderação: 27/09/2026 11h26 (2 months later)
• Estado: Aceite
• Entrada VulDB: 410858 [Eyeplus 57.0.0.0308 p2pcam Service /snapshot Divulgação de Informação]
• Pontos: 20