CVE-2024-42531 describes a vulnerability in the Ezviz Internet PT Camera CS-CV246 D15655150 where an unauthenticated attacker can send crafted RTSP packets with particular URLs to redirect the camera feed and access the live video stream. Despite the high CVSS score of 9.8 indicating critical severity, the vendor's assessment clarifies that the provided sample code can only establish RTSP communication but does not allow retrieval of video or audio data, effectively negating the risk of unauthorized video access. There is no patch or remediation information available, and the device is not a cloud service.

If exploitable as initially described, the vulnerability would allow unauthenticated attackers to access live video streams, compromising confidentiality, integrity, and availability of the camera feed. However, the vendor's perspective indicates that actual video or audio data cannot be obtained through the demonstrated method, meaning the practical impact is nullified. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor states that the sample code cannot obtain video or audio data, implying no immediate risk and no action required at this time. Monitor vendor communications for updates or official fixes.