EUVD-2026-88072
GHSA-2c79-57wq-9m67
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ONVIF service on network
-
ExploitSend unauthenticated GetUsers request to /onvif/Device
-
ExecutionReceive user list with plaintext passwords
-
ImpactReuse credentials for admin takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the device's ONVIF Device service endpoint (/onvif/Device) on Eyeplus firmware 57.0.0.0308; the GetUsers operation returns user accounts including plaintext passwords without authentication (PR:N/UI:N). No special configuration, credentials, or user interaction is needed - the limiting factor is simply network exposure of the ONVIF interface, which on IoT cameras/NVRs is often LAN-restricted unless the device is internet-exposed or port-forwarded. |
| Impact | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N, score 6.9) describes a network-reachable, unauthenticated, low-complexity information disclosure with no user interaction - a genuinely easy-to-trigger flaw. Crucially, the public exploit reference is titled 'GetUsers-Unauth-Plaintext-Password', indicating the ONVIF GetUsers call returns user accounts WITH plaintext passwords, so the real confidentiality impact is credential disclosure (arguably VC:H / C:H), which VulDB understates as VC:L. Because leaked device credentials typically enable full administrative takeover of the camera/NVR, the practical severity is higher than the 6.9 suggests. Countervailing signals keep this from being an urgent priority: there is no EPSS score provided, no CISA KEV listing, and the sole source is a VulDB community submission for an obscure IoT vendor (Eyeplus) with no independent vendor advisory or confirmed patch. SSVC-style read: exploitation is 'PoC' (E:P in the vector, public exploit code exists) rather than 'active'; automatable=yes (unauth, single request); technical impact is total for the device if credentials are reused. Net: technically easy and impactful per device, but low real-world footprint and no evidence of widespread exploitation. |
| Exploit ScenarioDerived | An attacker who can reach the device's ONVIF service on the network sends an unauthenticated GetUsers request to /onvif/Device and receives the configured user accounts along with their plaintext passwords. A public proof-of-concept exists (devjanger/iot-advisories), so no exploit development is required; the recovered admin credentials can then be reused to fully control the camera/NVR. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Unauthenticated information disclosure in Eyeplus firmware 57.0.0.0308 lets remote attackers retrieve user account records - including plaintext passwords - by invoking the GetUsers operation on the ONVIF Device service at /onvif/Device. Both the vendor CVSS 4.0 vector (6.9) and the independent assessment (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) agree the flaw is network-reachable, unauthenticated (PR:N), requires no user interaction, and yields high confidentiality impact with no integrity or availability effect. Publicly available exploit code exists (a GitHub proof-of-concept advisory), and because credentials are returned in cleartext the exposure is especially severe - the only limiting factor is network reachability of the ONVIF interface, which is frequently LAN-restricted unless the device is internet-exposed or port-forwarded.
RemediationAI
No vendor-released patch version is identified in the available data (status: no vendor-released patch identified at time of analysis), so the priority is eliminating exposure of the vulnerable endpoint. Because the attack needs only network reachability to /onvif/Device and requires no credentials (PR:N/UI:N), first remove the ONVIF Device service from untrusted networks: block internet exposure and port forwarding to the camera's web/ONVIF ports, and restrict LAN access to the device via firewall ACLs or VLAN segmentation so only trusted management hosts can reach it - the trade-off is loss of remote/off-LAN access to the ONVIF interface. If ONVIF integration is not required, disable ONVIF/third-party integration entirely in the device configuration; this eliminates the attack surface but breaks NVR or VMS platforms that rely on ONVIF. Where the endpoint must remain reachable, place it behind a reverse proxy or WAF rule that denies unauthenticated requests to the /onvif/Device SOAP path, though this adds operational complexity and can interfere with legitimate ONVIF clients. Critically, treat any credentials entered on or stored by these devices as compromised and rotate camera/web/NVR account passwords and any reused credentials elsewhere, since GetUsers returns plaintext passwords; password rotation does not fix the flaw and the endpoint remains exploitable until exposure is removed or firmware is patched. Monitor vendor channels (including the VulDB advisories linked above) for a fixed firmware release and, once available, upgrade Eyeplus firmware beyond 57.0.0.0308.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ONVIF is an interoperability standard used by IP cameras, NVRs and similar IoT devices; its Device service (accessed at /onvif/Device) exposes SOAP operations for device management, including GetUsers, which is supposed to be protected by authentication such as WS-UsernameToken. In Eyeplus firmware 57.0.0.0308 the GetUsers handler fails to enforce that authentication and returns sensitive account data, mapping to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - here the worse variant of returning credentials in plaintext rather than hashed. The CPE entry cpe:2.3:a:n/a:eyeplus:*:*:*:*:*:*:*:* leaves the vendor slot unset, so exact affected build coverage beyond 57.0.0.0308 is not enumerated in the source data, though the wildcard suggests the flaw is tracked at the product level rather than a single build. The issue is a pure confidentiality breach: no write or denial-of-service primitive is present (VC:L per vendor, C:H under the independent 3.1 assessment; VI:N/VA:N in both).
Know when Eyeplus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Unauthenticated remote ONVIF GetUsers call discloses plaintext credentials (C:H, not the vendor's C:L), enabling device takeover; no direct integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipulation results in information disclosure. The attack can be executed remotely. The exploit is now public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote unauthenticated denial of service in Eyeplus 57.0.0.0308 p2pcam HTTP parser allows an attacker who can reach the
Unauthenticated snapshot disclosure in the Eyeplus IoT camera (version 57.0.0.0308) lets any attacker with network reach
Exploit-DB