CVE-2026-38740: Foscam VD1 Doorbell Plaintext RTC Signaling and TURN Abuse Vulnerability

CVE-2026-38740: Foscam VD1 Doorbell Plaintext RTC Signaling and TURN Relay Abuse Vulnerability Vulnerability Overview A critical security flaw exists in the Real-Time Communication (RTC) implementation of the Foscam VD1 doorbell. During connection establishment, the device transmits sensitive Session Description Protocol (SDP) data, including ICE credentials ( and ), over plaintext network interfaces. Attackers can intercept these credentials via network sniffing, enabling them to hijack media streams or leverage the vendor's TURN relay infrastructure to forward arbitrary traffic. Affected Products Affected Product: Foscam VD1 Video Doorbell Affected Versions: All versions prior to V5.3.13_1072 CVSS Score: 8.3 (High) Key Risks: 1. Infrastructure Financial Abuse: Attackers can exploit Foscam’s paid relay bandwidth for personal use or malicious activities, causing financial losses to the vendor. 2. Stream Redirection/Hijacking: By hijacking ICE candidates found in plaintext signaling, attackers can redirect video streams to external endpoints. Remediation 1. Enforce TLS Encryption: All SDP exchanges must be encapsulated within a TLS-encrypted channel (HTTPS/WSS) to protect ICE credentials. 2. Use Temporary TURN Credentials: Implement the TURN REST API (see RFC 5766) to generate short-lived, session-specific credentials that expire within minutes. 3. Credential Monitoring: Decommission any long-term static keys currently in use and monitor TURN logs to detect anomalous bandwidth usage patterns. Proof of Concept (PoC) 3.1 Interception 1. Monitor traffic originating from the doorbell. 2. Capture outbound signaling packets. 3. Extract credentials from the SDP payload. 3.2 Relay Verification 1. Use the extracted credentials to attempt connection to the Foscam TURN server identified in the ICE candidates. 2. Successfully authenticate and relay non-camera traffic through the Foscam infrastructure. Code Block Extraction (Note: The screenshot contains a partially obscured code block. The following is the complete code extracted from the visible content) ```javascript // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) // ... (partially obscured code) //

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-38740: Foscam VD1 Doorbell Plaintext RTC Signaling and TURN Abuse Vulnerability

More from this source