CVE-2026-38740

Executive Summary

CVE-2026-38740 is a cleartext transmission vulnerability (CWE-319) affecting Foscam VD1 Video Doorbell firmware prior to version V5.3.13_1072. The device transmits Session Description Protocol (SDP) data — including Interactive Connectivity Establishment (ICE) credentials and candidate information — over unencrypted network interfaces. An attacker positioned on the local network or upstream path can capture these credentials to hijack active media streams, impersonate the device, or abuse Foscam's TURN/relay infrastructure, incurring bandwidth costs and enabling man-in-the-middle attacks against video/audio feeds. The vulnerability has a CVSS score of 5.3 (Medium) and is not listed on CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The Foscam VD1 uses WebRTC underpinnings for peer-to-peer (P2P) and relayed media connectivity. During call setup, the device generates an SDP offer/answer exchange containing:

• ice-ufrag and ice-pwd — short-term credentials required to authenticate STUN connectivity checks
• ICE candidate attributes, including candidate lines exposing local IPs, ports, and transport protocols (UDP/TCP)
• TURN server credentials or relay-derived candidates, specifically the Foscam-hosted TURN/relay allocation.

The flaw lies in the transport pathway: the device sends this SDP payload over plaintext HTTP or unencrypted TCP/UDP channels rather than enforcing DTLS-SRTP or WSS/TLS for signaling. The signaling exchange flows between the VD1, the Foscam cloud relay, and the companion mobile app.

From a protocol-level view:

1. The VD1 initiates a session to the Foscam cloud over port 80/443.
2. During ICE negotiation, the SDP blob with ice-pwd and candidates traverses the network unencrypted.
3. An attacker with passive sniffing capability (e.g., on the same Wi-Fi, a compromised router, or an upstream ISP) captures the traffic.

Attack surface specifics:

• Local network: The VD1 broadcasts mDNS/Bonjour and communicates via unicast HTTP to the app on ports 8080 or 88 for setup; SDP exchange may also occur over plain UDP to the cloud.
• Upstream visibility: If the device is behind a router that logs or tunnels traffic, or via ARP spoofing, credentials leak in transit.
• Cloud relay abuse: The leaked TURN credentials allow an attacker to authenticate to Foscam's relay servers and forward arbitrary UDP/TCP traffic, bypassing NAT, consuming vendor bandwidth, and obfuscating attacker origin.

The vulnerability is not a buffer overflow or injection — it is a pure cryptographic/transport hygiene failure. The device does not enforce encryption on session initiation, making passive eavesdropping trivial with standard tools like tcpdump or Wireshark, or active interception with bettercap.

Exploitation Scenarios

Scenario 1: Passive Media Stream Hijacking

1. Recon: Attacker scans the local network (e.g., 192.168.1.0/24) for the VD1's default hostname or mDNS advertisement (foscam_vd1._tcp.local). Nmap identifies open ports 88 (HTTP), 554 (RTSP), and 554/UDP.
2. Trigger: Victim opens the Foscam mobile app and livestreams the doorbell. This initiates an SDP offer from the VD1 to the cloud relay.
3. Capture: Attacker runs tcpdump -i eth0 -A 'udp port 3478 or tcp port 554' or uses Wireshark with a display filter for sdp and ice-ufrag to grab the SDP body from the plaintext HTTP POST to the relay.
4. Weaponize: Offline, attacker extracts a=ice-ufrag:abc123 and a=ice-pwd:xyz789. Using a WebRTC client library (e.g., Python aiortc), they construct an SDP offer with the stolen ICE credentials and connect to the doorbell's media ports (RTP over UDP 5004-5010).
5. Post-exploitation: The attacker receives the live H.264/AAC stream, gains persistent covert surveillance, and can inject forged RTCP packets to terminate the legitimate viewer's session.

Scenario 2: TURN/Relay Infrastructure Abuse

1. Recon: Attacker identifies Foscam TURN server domains from leaked SDP candidates (e.g., turn.foscam.com:3478).
2. Capture: As above, sniff the SDP containing a=ice-pwd and a=ice-ufrag bound to the TURN server.
3. Exploit: Using turnutils_uclient (or a custom TURN client), attacker authenticates to turn.foscam.com:3478 with the stolen credentials and requests an allocation.
4. Abuse: The attacker now has a public relay IP:port. They tunnel arbitrary TCP/UDP traffic (e.g., exfiltration, C2, or proxying botnet traffic) through Foscam's infrastructure, making attribution point to Foscam's cloud, not the attacker.
5. Impact: Foscam incurs data transfer costs; the attacker gains anonymous egress. If the doorbell's firewall allows inbound from the relay, the attacker can also pivot to internal network devices.

Note: Both scenarios require network adjacency (same LAN or upstream visibility) but no physical access to the device.

Impact Assessment

• Confidentiality: High — real-time video/audio interception of residential or commercial entryways.
• Integrity: Medium — attacker can inject RTCP feedback to disrupt streams or forge ICE connectivity checks to blackhole media.
• Availability: Low-Medium — DoS via flooding the relay allocation or purposefully misrouting media.
• Financial: Indirect — Foscam bears TURN bandwidth costs; victim may face privacy lawsuits or insurance claims.
• Blast radius: All Foscam VD1 deployments prior to V5.3.13_1072, including residential, small office, and boutique retail environments. The leaked ICE credentials are valid for the session duration (typically 5-10 minutes), but TURN credentials may persist longer depending on server allocation lifetimes.
• CVSS subscores (implicit from vector): AC:L, PR:N, UI:N — no authentication or user interaction needed; S:U (scope unchanged).

Detection Guidance

Sigma Rule

title: Foscam VD1 Cleartext SDP Transmission
id: 5e5f2a1b-8c3d-4f6a-9b7e-2d4a8f1c9e3b
status: experimental
description: Detects plaintext SDP/ICE credential leakage from Foscam VD1 devices
logsource:
  category: network_connection
  product: suricata
detection:
  selection_http:
    http.url|contains: '/sdp'
    http.method: 'POST'
  selection_sdp:
    http.response_body|contains|all:
      - 'a=ice-ufrag:'
      - 'a=ice-pwd:'
  condition: selection_http and selection_sdp
fields:
  - src_ip
  - dst_ip
  - http.url
  - http.response_body
falsepositives:
  - Legitimate unencrypted WebRTC traffic (rare)
level: high

YARA Rule

rule Foscam_VD1_SDP_Cleartext
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects cleartext SDP with ICE credentials in network captures or firmware strings"
        date = "2026-02-15"
        cve_id = "CVE-2026-38740"
    strings:
        $ice_ufrag = "a=ice-ufrag:" ascii wide
        $ice_pwd = "a=ice-pwd:" ascii wide
        $foscam_domain = "foscam.com" ascii wide
        $sdp_header = "v=0\r\no=" ascii wide
    condition:
        uint16(0) == 0xd4a3 or filesize < 10MB
        and $ice_ufrag
        and $ice_pwd
        and ($foscam_domain or $sdp_header)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-38740 - Foscam VD1 Cleartext SDP/ICE Credential Exfiltration"; flow:to_server,established; content:"a=ice-ufrag:"; nocase; content:"a=ice-pwd:"; nocase; sid:202638740; rev:1; metadata:cve CVE-2026-38740; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-38740;)

Elastic Detection

sequence by host.name, process.pid
  [ network where
      network.direction == "egress" and
      destination.port in (80, 8080, 3478) and
      network.transport == "tcp"
  ]
  [ file where
      file.name : "*.pcap" or process.name : ("tcpdump", "wireshark", "bettercap")
  ]
  until 5 minutes

Splunk SPL Query

index=network sourcetype=suricata
| search "a=ice-ufrag" OR "a=ice-pwd" OR "CVE-2026-38740"
| stats count by src_ip, dest_ip, http_url
| where count > 5
| table _time, src_ip, dest_ip, http_url, count
| sort -count

Wazuh OSSEC Rule

<group name="foscam,cve-2026-38740,">
  <rule id="922801" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">alert</field>
    <field name="alert.signature">Foscam VD1 Cleartext SDP</field>
    <description>CVE-2026-38740: Foscam VD1 sending cleartext ICE credentials</description>
    <mitre>
      <id>T1557</id>
    </mitre>
    <group>network,attacker,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. However, the NVD description specifies "before V5.3.13_1072", indicating a patched firmware version EXISTS.

1. Immediate mitigations:

   • Isolate the VD1 on a segmented VLAN with strict egress firewall rules; block outbound TCP/UDP to non-Foscam IPs except port 443.
   • Disable P2P mode in the Foscam app settings and force relay-only via TLS (if configurable).
   • Use a VPN or encrypted Wi-Fi (WPA2/WPA3-Enterprise) to reduce LAN sniffing risk.
   • Monitor outbound traffic for unexpected TURN allocations (port 3478 UDP/TCP).

2. Patch/Upgrade steps:

   • Update firmware to V5.3.13_1072 or later (mandatory fix) via the Foscam app (Settings → Device Info → Firmware Update) or direct download from www.foscam.com/downloads.
   • After upgrade, verify ice-pwd values are no longer visible in packet captures.

3. Long-term hardening:

   • Replace the device with a model that natively supports DTLS-SRTP and WSS signaling.
   • Disable UPnP on the router to prevent automatic port forwarding.
   • Implement network anomaly detection (Zeek/Suricata) for SDP/STUN traffic patterns.
   • Rotate any previously exposed TURN credentials by renewing the device's session and cloud account keys.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-38740 — Official CVE metadata and CVSS vector.
2. Foscam Firmware Downloads: https://www.foscam.com/downloads/firmware.html — Contains patched build V5.3.13_1072.
3. CWE-319 Detail: https://cwe.mitre.org/data/definitions/319.html — Cleartext Transmission of Sensitive Information.
4. ATT&CK T1557 — Adversary-in-the-Middle: https://attack.mitre.org/techniques/T1557/ — Mapping for interception-based exploitation.
5. WebRTC Security Architecture (RFC 8827): https://datatracker.ietf.org/doc/html/rfc8827 — Reference for mandatory DTLS-SRTP enforcement, violated by this flawed implementation.

Campaign Evidence: No public exploitation campaigns or exploit-in-the-wild reports as of the publication date. EPSS score (0.00131, percentile 3.1%) indicates low current exploitation likelihood, but the passive nature of the attack and ubiquitous IoT deployment make it a prime target for future botnet or surveillance tooling.