Camera Spoofing Vulnerability in VStarCam Products
CVE-2019-11014
What is CVE-2019-11014?
The VStarCam vstc.vscam.client library and the associated vstc.vscam shared object included in the Eye4 application expose users to a significant security risk due to inadequate prevention measures against camera server spoofing. Attackers can exploit this flaw by creating a fraudulent camera server that captures the client's request for a camera on the local network. When the legitimate camera responds through the broadcast address, it inadvertently reveals sensitive information necessary for the attacker to impersonate the camera. Subsequently, the attacker can overwhelm the client with false responses, effectively denying service to the legitimate camera and forcing the client to interact solely with the malicious server. This interaction can lead to the compromise of critical authentication credentials, such as usernames and passwords, jeopardizing user privacy and security.