CVE-2019-10711
High
Description
Incorrect access control in the RTSP stream and web portal on all IP cameras based on Hisilicon Hi3510 firmware (until Webware version V1.0.1) allows attackers to view an RTSP stream by connecting to the stream with hidden credentials (guest or user) that are neither displayed nor configurable in the camera's CamHi or keye mobile management application. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda, BESDER, WUSONGLUSAN, GADINAN, Unitoptek, ESCAM, etc.
SeverityHigh
CVSS7.5
Exploit probability—
ProductHisilicon Hi3510 Firmware
PublishedApr 23, 2019
First seenApr 23, 2019
How to fix
Update
- hisilicon hi3510_firmware1.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hisilicon hi3510_firmware | v < 1.0.1 | 1.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.