{"id":"CVE-2025-70962","published":"2026-08-05T14:16:58.390","lastModified":"2026-08-05T20:17:04.247","description":"Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized viewing of camera footage.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://github.com/namaek2/CVE-2025-70962","tags":[]},{"url":"https://www.zositech.com/","tags":[]},{"url":"https://github.com/namaek2/CVE-2025-70962","tags":[]}],"exploitRefs":[{"url":"https://github.com/namaek2/CVE-2025-70962","tags":[]},{"url":"https://github.com/namaek2/CVE-2025-70962","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows network attackers to access hardcoded credentials in RTSP authentication, enabling unauthorized viewing of camera footage.","exploitability":"Exploitation is relatively easy as it requires only network access and knowledge of default credentials.","blast_radius":"If exploited, this could lead to widespread unauthorized surveillance of protected areas.","remediation":"Update the firmware to remove hardcoded credentials and enforce strong authentication mechanisms.","tags":["auth-bypass","video-streaming","network-security"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:59:34.916Z"}}