EUVD-2026-88073
GHSA-6r4w-hr6c-g2hw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed p2pcam service
-
ExploitSend unauthenticated GET /snapshot
-
ExecutionServer returns camera image
-
ImpactDisclose private video snapshot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Eyeplus p2pcam service's /snapshot endpoint on a device running version 57.0.0.0308; per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or special configuration is needed. The practical limiting factor is exposure: the p2pcam service must be reachable by the attacker (LAN, or Internet if the camera/P2P relay is exposed), and impact is confined to disclosure of a camera snapshot image (VC:L) with no integrity or availability effect. |
| Impact | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L only) describes an unauthenticated, low-complexity, remote information-disclosure flaw with no integrity or availability impact - internally consistent with the CWE-200 classification and the 'information disclosure' / 'remotely' language in the description. E:P (Proof-of-Concept) matches the confirmed public exploit on GitHub (devjanger/iot-advisories), so exploit code exists but there is no evidence of active exploitation: this is NOT in CISA KEV and no EPSS score is provided. This should be read as a real-but-narrow issue - trivially reachable (no auth, no user interaction) but bounded to confidentiality of a single P2P camera's snapshot, not device takeover. No SSVC decision data, no EPSS probability, and no KEV listing are supplied, so exploitation likelihood beyond 'PoC published' cannot be quantified from the input. The 6.9 rating is driven by the unauthenticated network vector, not by impact severity - a confidentiality-only leak, so treat as moderate rather than critical priority. |
| Exploit ScenarioDerived | A remote attacker on a network path to an Eyeplus P2P camera sends an unauthenticated request to the /snapshot endpoint of the p2pcam service and receives a current camera image without providing credentials. A public proof-of-concept documenting this unauthenticated snapshot disclosure is available on GitHub, lowering the barrier to reproduction. Because the CVSS vector is PR:N/UI:N/AC:L, exploitation requires only reachability to the service, no interaction or authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Unauthenticated snapshot disclosure in the Eyeplus IoT camera (version 57.0.0.0308) lets any attacker with network reachability to the device's p2pcam service retrieve a live camera snapshot from the /snapshot endpoint - no credentials, user interaction, or special configuration are required (CVSS:4.0 PR:N/UI:N/AC:L). Impact is confidentiality-only and low (VC:L, 6.9 base) with no integrity or availability effect, but publicly available exploit code exists: a proof-of-concept write-up is published in the GitHub advisory EYEPLUS-8001-Unauth-Snapshot-Disclosure, which raises the effective severity above the raw score. Real-world risk is governed by exposure, so cameras whose p2pcam/P2P service is reachable from the LAN, or from the internet when remote viewing is enabled, are the ones immediately affected.
RemediationAI
No vendor-released patch was identified at time of analysis; the only public artifacts are the VulDB record (https://vuldb.com/vuln/410858) and the researcher's advisory (https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-8001-Unauth-Snapshot-Disclosure.md), so administrators should contact Eyeplus support directly to obtain a fixed firmware build and re-check those references for updates. In the interim, remediation is exposure reduction: if a patched build is unavailable, disable remote/cloud P2P viewing in the camera's settings so the p2pcam service is not reachable from outside the LAN - the trade-off is loss of off-site live view, which some operators mitigate with a VPN instead of direct P2P. Place cameras on a dedicated, isolated VLAN with strict egress filtering to a known NVR or relay, and add firewall rules that drop inbound traffic to the device's p2pcam ports and to the /snapshot path from untrusted networks; note that blocking the endpoint outright (for example at a reverse proxy or ACL in front of the camera) also breaks legitimate snapshot integrations and client previews, so scope the rule to untrusted source ranges. Treat the leaked data as sensitive: rotate any credentials or QR/pairing codes visible in previously captured frames and audit device logs for unexpected /snapshot requests, since public exploit code exists and scanning for this endpoint is cheap.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the p2pcam service inside Eyeplus firmware 57.0.0.0308, an embedded P2P camera service that serves live still images through a /snapshot endpoint. The root cause maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the snapshot handler can be invoked by an unauthenticated remote party instead of enforcing an access check tied to the device owner's session or credentials. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P) is internally consistent with that reading - network-reachable, low complexity, no privileges or interaction, and a low confidentiality-only impact - and the E:P metric reflects that exploit code is publicly documented. The CPE entry cpe:2.3:a:n/a:eyeplus:*:*:*:*:*:*:*:* shows the vendor name is not registered in the CPE dictionary, so the wildcard covers every tracked Eyeplus version rather than a validated version range; the description pins the tested build to 57.0.0.0308. Because the disclosed artifact is a camera frame rather than firmware or credentials, the class of exposure is a privacy/intelligence leak (occupancy, physical layout, and anything visible in frame) rather than a path to code execution or persistence.
Know when Eyeplus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Unauthenticated (PR:N), low-complexity remote (AV:N/AC:L) request to /snapshot yields a limited confidentiality leak (C:L) with no integrity or availability impact and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is an unknown function of the file /snapshot of the component p2pcam Service. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote unauthenticated denial of service in Eyeplus 57.0.0.0308 p2pcam HTTP parser allows an attacker who can reach the
Unauthenticated information disclosure in Eyeplus firmware 57.0.0.0308 lets remote attackers retrieve user account recor
Exploit-DB