Description

A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is an unknown function of the file /snapshot of the component p2pcam Service. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-28T05:16:28.140Z",
  "pubdate": "2026-09-28T05:16:28.140Z",
  "executiveSummary": "A critical information disclosure vulnerability has been identified in the p2pcam Service component of Eyeplus version 57.0.0.0308. The vulnerability originates from an insecure function within the /snapshot file, which allows unauthorized actors to retrieve sensitive information from the system.\nThis flaw is exploitable remotely over a network without requiring specific authentication, posing a significant risk to the confidentiality of the device's data. Publicly available exploit code increases the likelihood of successful exploitation by malicious actors.\nSuccessful exploitation results in the unauthorized disclosure of information, which could potentially expose snapshots or camera telemetry data. Given the remote accessibility and the availability of exploit material, this vulnerability presents a high risk to the security posture of affected Eyeplus surveillance systems.",
  "technicalDetails": "The vulnerability resides within the p2pcam Service component of the Eyeplus firmware, specifically targeting the /snapshot handler. The implementation fails to enforce adequate access control or validation mechanisms for requests directed toward this endpoint.\nThe root cause is an insecure function exposed by the /snapshot service, which processes incoming requests and returns sensitive data to the requester without verifying the user's authorization status or session context. Because this interface is reachable remotely through standard network protocols, an attacker can trigger the disclosure of captured snapshots or system imagery by sending specially crafted requests to the p2pcam Service.\nThe attack flow begins with the discovery of the target device on a network. The attacker initiates a request to the /snapshot file, bypassing authentication checks due to the flawed design of the p2pcam Service component. The application backend processes the request and executes the vulnerable function, which subsequently leaks protected data back to the attacker's endpoint. As the exploit is publicly documented, attackers can utilize pre-written scripts to automate this process, allowing for bulk scraping of sensitive snapshots from vulnerable Eyeplus units.\nThe vulnerability affects Eyeplus version 57.0.0.0308. Since the p2pcam Service is designed to operate as a core component of the camera's network management interface, the exploit does not require local access, administrative privileges, or prior knowledge of credentials. The lack of input validation and authentication at the entry point of the /snapshot handler ensures that any remote actor with network visibility can successfully perform the unauthorized retrieval of information.\nPost-exploitation impact involves the exfiltration of private camera imagery, which compromises the integrity and privacy of the surveillance environment. This information disclosure is static and persistent, meaning that each unauthorized request results in the immediate leakage of current data stored or processed by the p2pcam Service. There are no secondary checks or traffic filtering mechanisms currently mitigating this path, facilitating immediate and repeatable unauthorized access to the system's snapshot outputs."
}