What is the CVSS score of CVE-2026-38740?

CVE-2026-38740 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Foscam VD1 Video Doorbell CVE-2026-38740

EUVD-2026-30372 MEDIUM

Cleartext Transmission of Sensitive Information (CWE-319)

2026-05-14 mitre

GHSA-hj3c-m4r3-m5fj

Information Disclosure N A

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:24 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

5.3 (MEDIUM)

CVE Published

May 14, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The device transmits sensitive Session Description Protocol (SDP), including ICE credentials and candidates, in cleartext over network interfaces. An attacker with network visibility can intercept these credentials to hijack media streams or authenticate to Foscam's TURN/relay infrastructure to forward arbitrary traffic at the vendor's expense.

AnalysisAI

Cleartext transmission in Foscam VD1 Video Doorbell (firmware before V5.3.13_1072) exposes Session Description Protocol (SDP) credentials and ICE candidates over unencrypted network channels, enabling on-path attackers to intercept media stream authentication tokens, hijack real-time video/audio feeds, and abuse Foscam's TURN relay infrastructure for unauthorized traffic routing. EPSS score of 0.02% (5th percentile) suggests low widespread exploitation likelihood, though the network-accessible attack vector (AV:N) with no authentication requirement (PR:N) and low complexity (AC:L) creates risk in residential deployment scenarios where LAN or ISP-level interception is feasible.

Technical ContextAI

The vulnerability stems from CWE-319 (Cleartext Transmission of Sensitive Information) in Foscam's WebRTC implementation. Session Description Protocol (SDP) is used in WebRTC to negotiate peer-to-peer media connections, containing Interactive Connectivity Establishment (ICE) credentials (username fragments and passwords) and candidate addresses for NAT traversal. ICE credentials authenticate STUN/TURN binding requests to establish media paths. TURN (Traversal Using Relays around NAT) servers are vendor-operated relay infrastructure for NAT traversal when direct peer connections fail. By transmitting these parameters in cleartext rather than over TLS/DTLS-protected channels, the device violates WebRTC security baseline requirements defined in RFC 8827. Attackers capturing SDP exchanges can extract ICE credentials to impersonate legitimate endpoints, intercept SRTP keys if exchanged via SDP, or authenticate to TURN servers as the victim device.

RemediationAI

Upgrade Foscam VD1 Video Doorbell firmware to version V5.3.13_1072 or later, available through Foscam's support portal or device automatic update mechanism (verify firmware signature before installation). The patch presumably implements TLS/DTLS encryption for SDP signaling channels per WebRTC security requirements. Firmware update procedure and release notes are detailed in the researcher advisory at https://github.com/victorGoeman/Foscam-Security-Research/blob/main/CVE-2026-38740.md and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-38740. For devices awaiting patching, implement network-layer compensating controls: isolate video doorbell on dedicated VLAN with restricted routing to only required cloud endpoints (deny lateral LAN access), deploy WPA3-SAE on wireless segments to prevent Wi-Fi eavesdropping, and monitor for anomalous TURN server authentication attempts in network logs if Foscam provides API access. These mitigations reduce on-path interception risk but do not eliminate exposure if attacker controls upstream network infrastructure (router, ISP). Network isolation may impact legitimate LAN-based doorbell access from companion apps if not configured to permit required cloud relay paths.