The vulnerability identified as CVE-2024-51362 affects the LSC Smart Connect Indoor IP Camera version 7.6.32. It involves an information disclosure flaw where the Real Time Streaming Protocol (RTSP) service running on port 8554 does not enforce authentication, allowing any network-connected attacker to access live camera footage without credentials. RTSP is commonly used for streaming media, and in this case, the camera exposes its video feed openly. The lack of authentication (CWE-306) means that confidentiality is directly compromised, as unauthorized users can view sensitive video streams. The vulnerability requires network access but no privileges or user interaction, making it relatively easy to exploit within the same network or via exposed network segments. The CVSS 3.1 base score is 6.5 (medium), reflecting high confidentiality impact but no impact on integrity or availability. No patches or fixes have been published yet, and no known exploits have been observed in the wild. This vulnerability poses a significant privacy risk, especially in environments where these cameras monitor sensitive areas. The issue highlights the importance of proper authentication controls on networked IoT devices, particularly those handling sensitive data streams.

The primary impact of this vulnerability is the unauthorized disclosure of live video feeds, which can lead to severe privacy violations for individuals and organizations. Attackers can surveil sensitive areas, gather intelligence, or conduct reconnaissance without detection. This can result in reputational damage, regulatory non-compliance (especially under privacy laws like GDPR), and potential physical security risks. Since the vulnerability does not affect integrity or availability, it does not allow attackers to manipulate video streams or disrupt camera operation, but the confidentiality breach alone is significant. Organizations relying on these cameras for security monitoring may have their surveillance compromised, undermining trust in their security infrastructure. The ease of exploitation without authentication and user interaction increases the likelihood of opportunistic attacks, especially in environments with exposed or poorly segmented networks.

1. Immediately restrict network access to the RTSP port (8554) by implementing firewall rules that limit connections to trusted IP addresses or internal networks only. 2. Segment the network to isolate IoT devices like IP cameras from general user and internet-facing networks to reduce exposure. 3. Monitor network traffic for unusual or unauthorized RTSP connection attempts to detect potential exploitation. 4. Disable RTSP streaming if not required or replace it with a more secure streaming protocol that enforces authentication. 5. Regularly audit and update camera firmware; although no patch is currently available, stay alert for vendor updates addressing this vulnerability. 6. Consider deploying network intrusion detection/prevention systems (IDS/IPS) with signatures for unauthorized RTSP access. 7. Educate staff on the risks of exposed IoT devices and enforce strong network security policies. 8. If possible, configure the camera or network equipment to require authentication for RTSP streams, even if this requires custom configuration or vendor support.