V380 IP Camera EUVD-2026-37894

Q: What is the CVSS score of EUVD-2026-37894?

EUVD-2026-37894 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:X/U:Red. EPSS exploitation probability: 0.2%.

| CVE-2026-12527 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-06-18 1c6b5737-9389-4011-8117-89fa251edfb2

GHSA-4fqm-96mj-r77p

Authentication Bypass

6.0

CVSS 4.0 · Vendor: 1c6b5737-9389-4011-8117-89fa251edfb2

Severity by source

Vendor (1c6b5737-9389-4011-8117-89fa251edfb2) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:X/U:Red

vuln.today AI

6.5 MEDIUM

Adjacent-only attack vector (AV:A) required per RTSP network access; no privileges or interaction needed; impact is confidentiality-only via unauthorized video stream retrieval.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (1c6b5737-9389-4011-8117-89fa251edfb2).

CVSS VectorVendor: 1c6b5737-9389-4011-8117-89fa251edfb2

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 14:34 vuln.today

DescriptionCVE.org

A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1_V1.0.6.020230803 enables unauthenticated network actors to bypass the device’s credential-enforced live-view workflow and directly retrieve real-time video stream data.

AnalysisAI

Unauthenticated live video stream access on the V380 IP Camera (firmware AppFHE1_V1.0.6.020230803, Shenzhen Liandian Communication Technology LTD) is achievable by any adjacent-network attacker who directly queries the RTSP media delivery endpoint, entirely bypassing the credential-enforced live-view authentication workflow. The root cause, CWE-306 (Missing Authentication for Critical Function), confirms that the RTSP pipeline lacks the authentication gate applied to the device's primary viewing interface - a structural authorization boundary failure rather than a logic bypass. The CVSS 4.0 supplemental metrics flag this as automatable (AU:Y), urgency Red (U:Red), and safety-impacting (S:P), elevating real-world priority for deployments in sensitive physical security environments despite the adjacent-only attack vector; no public exploit identified at time of analysis, though a researcher's GitHub documentation provides significant technical detail.

Technical ContextAI

The V380 IP Camera employs the Real Time Streaming Protocol (RTSP), a stateful application-layer protocol (typically TCP port 554) designed to negotiate and control delivery of real-time media streams between servers and clients. RTSP sessions are normally gated by an authentication challenge-response, and the V380's live-view interface enforces credential checks at the application layer. CWE-306 (Missing Authentication for Critical Function) identifies the specific failure: the RTSP media delivery pipeline - a distinct code path from the main viewing interface - omits this authentication enforcement, allowing direct stream retrieval without credentials. The affected firmware is specifically identified as AppFHE1_V1.0.6.020230803; no CPE string was provided in the source data, so precise CPE-based scope cannot be confirmed. The CVSS 4.0 vector's AT:P (Attack Requirements: Present) metric confirms that exploitation is conditional on RTSP service availability and network adjacency, not a universally exploitable default state.

RemediationAI

No vendor-released patch or official firmware update has been identified at time of analysis; the sole reference is a researcher's GitHub documentation with no associated vendor response or fix version. The primary compensating control is network segmentation: place V380 cameras on a dedicated IoT VLAN with firewall rules blocking cross-segment access to TCP port 554 (RTSP), which eliminates the adjacent-network attack surface for unauthorized clients. Trade-off: legitimate RTSP clients (NVRs, viewing applications) must reside in the same VLAN or have explicit firewall rules permitting access. Where VLAN segmentation is not feasible, disabling RTSP streaming functionality via the camera's administration interface (if such an option exists in the firmware) eliminates the vulnerable endpoint entirely at the cost of losing RTSP-based live-view capability. Consumers should actively monitor the vendor's firmware release channels for an update addressing RTSP authentication enforcement. If the camera is exposed beyond the immediate local network, immediate isolation is warranted given the high confidentiality impact on video stream data.