Xiongma/InterVideo Sofia IPC Unauthenticated RTSP Video Stream Access (CVE-2026-79394)

Vulnerability Overview CVE ID: CVE-2026-79394 Vulnerability Name: Unauthenticated RTSP Video/Audio Stream Access in Xiongma/InterVideo Sofia IPC daemon (authentication disabled by default, ) Vulnerability Type: Unauthenticated Access / Insecure Default Configuration CVSS v3.1 Score: 7.5 (High) Status: Confirmed (CONFIRMED) — Real-time video stream accessible without credentials by playing in VLC Scope of Impact Affected Products: IP cameras and DVR/NVR products using the Xiongma/InterVideo Sofia daemon (embedded "Happymite" RTSP server, based on the open-source XMRTP component) Affected Builds: Firmware , executable system image Architecture: ARM 32-bit LE, uClibc 0.3.3, statically linked Impact: - Unauthenticated real-time video/audio stream access (CWE-319) - Unencrypted stream transmission (CWE-319) - Passive sniffing of RTSP streams on the LAN Technical Details 3.1 Authentication Gating The authentication logic is located in (RTSP request dispatcher) Key check: defaults to 0 (authentication disabled), causing anonymous requests to be accepted 3.2 Digest Authentication Mechanism Digest authentication exists but is bypassed by default ( ) Digest challenge function , MD5 digest calculation 3.3 Reachability and URLs Listens on TCP 554 ( ) Stream URL templates are hardcoded in the binary 3.4 Plaintext Transmission RTSP media streams are transmitted unencrypted and can be passively sniffed on the LAN 3.5 Reproduction (2026-08-08) 1. Play in VLC 2. Without authentication headers, the server accepts the anonymous request and returns 200 along with an SDP (H.264 video, G.711 audio) 3. establishes the stream, and initiates transmission 4. Passive sniffing of RTSP streams on the LAN Remediation 1. Modify factory configuration: Change from 0 to 1 to enable authentication 2. Enforce hardcoded default credentials: / , forcing a password change on first boot 3. Enable encrypted transmission: RTSP-over-TLS or encrypted RTSP 4. Defense against RTSP authentication attempts: Log anonymous attempts and consider enforcing RTSP authentication on the LAN Timeline Related Vulnerabilities CVE-2026-79395: QVMS null pointer dereference (under default configuration) CVE-2026-79396: Hardcoded default credentials

Goal Reached Thanks to every supporter — we hit 100%!

Xiongma/InterVideo Sofia IPC Unauthenticated RTSP Video Stream Access (CVE-2026-79394)

More from this source