CVE-2025-70962: Zosi C519M Auth Bypass Vulnerability

CVE-2025-70962 Overview

CVE-2025-70962 affects the Zosi C519M V4.2.8.823C01450BA IP camera. The device contains hardcoded credentials in its Real Time Streaming Protocol (RTSP) authentication mechanism. An unauthenticated attacker with network access to the camera can supply the fixed default credentials to retrieve the live video stream. Because the credentials cannot be changed by the user, the exposure persists across configuration changes and firmware sessions. The weakness is classified under CWE-284: Improper Access Control and results in unauthorized viewing of camera footage.

Critical Impact
Attackers on the same network as a Zosi C519M V4 camera can view the RTSP video feed without valid user credentials, breaching the confidentiality of monitored spaces.

Affected Products

Zosi C519M V4 IP camera, firmware version V4.2.8.823C01450BA
Deployments exposing RTSP (TCP/554) to untrusted networks
Environments relying on default vendor authentication for RTSP streams

Discovery Timeline

2026-08-05 - CVE-2025-70962 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2025-70962

Vulnerability Analysis

The Zosi C519M V4 camera ships with credentials embedded in the RTSP authentication path. RTSP is the streaming control protocol commonly served on TCP port 554 by IP cameras. Because the credentials are hardcoded in firmware, the vendor-supplied username and password act as a persistent backdoor into the video stream.

An attacker who reaches the camera over the network can issue an RTSP DESCRIBE or PLAY request using the fixed credentials. The camera accepts the request and returns the live H.264 or MJPEG feed. No user interaction, prior compromise, or elevated privilege is required.

The weakness maps to CWE-284: Improper Access Control. It falls under the Hardcoded Credentials category of configuration and design flaws. Confidentiality of the surveillance feed is fully compromised, while integrity and availability of the device are not directly affected by this issue.

Root Cause

The root cause is the presence of static, non-configurable credentials inside the firmware that guards the RTSP interface. Camera owners cannot rotate or disable these credentials through the administrative console. The authentication mechanism therefore fails to bind stream access to an operator-controlled secret.

Attack Vector

Exploitation is remote and network-based. Any host that can route packets to the camera's RTSP port can authenticate using the hardcoded credentials. Attackers typically discover exposed devices through internet-wide scans for TCP/554 or through internal reconnaissance on flat networks. Once authenticated, the attacker consumes the RTSP session like a legitimate viewer.

Proof-of-concept material is published in the researcher's GitHub PoC repository. Refer to the repository for protocol-level request details.

Detection Methods for CVE-2025-70962

Indicators of Compromise

Inbound RTSP sessions to camera IP addresses from hosts outside the video management system (VMS) subnet.
Successful RTSP DESCRIBE, SETUP, or PLAY responses paired with the vendor's default account name in packet captures.
Unexpected concurrent RTSP viewer sessions beyond the count expected from the VMS.

Detection Strategies

Inspect network traffic for RTSP methods reaching Zosi C519M V4 devices from unapproved source addresses.
Correlate authentication events against the known vendor default account and alert on matches.
Use passive asset discovery to identify Zosi C519M V4 firmware version V4.2.8.823C01450BA on the network.

Monitoring Recommendations

Log all RTSP control-plane traffic on TCP/554 at network chokepoints between camera and enterprise segments.
Baseline expected RTSP client IPs (VMS, NVR, operator workstations) and alert on deviations.
Track outbound bandwidth from cameras to detect unauthorized stream consumers exfiltrating footage.

How to Mitigate CVE-2025-70962

Immediate Actions Required

Isolate Zosi C519M V4 cameras on a dedicated VLAN with no direct internet exposure.
Block inbound TCP/554 from untrusted networks at perimeter and internal firewalls.
Restrict RTSP access to the specific IP addresses of the video management system and authorized operator hosts.
Inventory all Zosi C519M V4 devices running firmware V4.2.8.823C01450BA and prioritize them for replacement or network containment.

Patch Information

No vendor patch is referenced in the CVE record at time of publication. Consult the Zositech vendor site for firmware updates and product advisories. Because the credentials are hardcoded, a firmware update from the vendor is required to remediate the underlying flaw; user configuration cannot remove the default account.

Workarounds

Place cameras behind an RTSP proxy or VPN that enforces its own authentication before relaying streams.
Terminate RTSP at the VMS and disallow direct client connections to the camera.
Where feasible, decommission affected units and replace them with cameras that support configurable RTSP credentials.

bash

# Example: restrict RTSP (TCP/554) to the VMS host only using iptables
# Replace <CAMERA_IF>, <VMS_IP>, and <CAMERA_SUBNET> with your values
iptables -A FORWARD -i <CAMERA_IF> -p tcp --dport 554 -s <VMS_IP> -d <CAMERA_SUBNET> -j ACCEPT
iptables -A FORWARD -i <CAMERA_IF> -p tcp --dport 554 -d <CAMERA_SUBNET> -j DROP