CVE-2025-70962

Use of Hard-coded Credentials in ZOSI C519M IP camera RTSP service

Summary

ZOSI C519M ships a hard-coded RTSP credential pair (admin:admin) stored in plaintext in /app/config.xml on the device filesystem, confirmed on firmware V4.2.8.832C01450BA. The RTSP service on TCP/554 accepts those credentials and the stream path is likewise fixed (/video1), both recoverable from strings in the IPC binary. Any remote attacker who can reach TCP/554 can therefore authenticate and pull the live video feed without any prior interaction with the owner.

The vendor does expose a "protection password" feature in the Zosi Smart app, but it rewrites only the user account credential. The admin credential is left untouched at admin:admin, and the device offers no interface through which an owner can change or disable it. The credentials ship inside the firmware image rather than being generated at first boot, so every unit running V4.2.8.832C01450BA carries the same admin values.

Impact

Unauthenticated remote disclosure of the live camera feed — a full loss of confidentiality for anything the camera observes. No user interaction and no privileges are required; only network reachability of TCP/554.

The score is limited to confidentiality because the demonstrated access path is read-only: the RTSP service serves the video stream and exposes no configuration or control capability, so the hard-coded credential does not by itself permit altering device settings or disrupting operation. Hence C:H/I:N/A:N rather than a device-takeover score. Enumeration of other services on the device was not exhaustive; if the same credential is accepted by another interface, the real-world impact would exceed the score given here.

On the attack vector. Recovering the credentials required one-time physical access to a single unit over UART. Exploiting the vulnerability does not. The same admin:admin pair is present on every device running this firmware and is now public, so any subsequent attacker needs nothing but network reachability of TCP/554 against any affected camera. The physical step belongs to discovery, which has already occurred and is not a barrier any attacker has to repeat. The attack vector is therefore Network (AV:N), not Physical.

Analysis

The firmware was obtained through the UART console exposed on the device's board; the IPC binary and /app/config.xml were extracted from the resulting image. This one-time physical step was required only to discover the credentials — see Impact for why it does not affect the attack vector of the vulnerability itself.

1. Port Check

• There was an open port 554 on the ZOSI C519M. Port 554 is the default port for RTSP (Real Time Streaming Protocol).

2. Find RTSP Configuration

• With IDA Pro, I extracted and reverse engineered the IPC binary of this product, where the function Rtspserver_Init() initializes the RTSP service.

• This function contains a hard-coded path to the RTSP configuration file.

• The hard-coded URL of the RTSP streaming service is likewise recoverable from strings in the extracted IPC binary.

• Finally, the hard-coded credentials themselves are stored in plaintext in /app/config.xml.

3. Credential Rotation Does Not Cover the admin Account

ZOSI documents a protection password feature for this model, set through the Zosi Smart app. Setting it does not remediate the issue: after configuring an app-side protection password and re-reading /app/config.xml, only the user account credential had been rewritten. The admin entry remained admin:admin on firmware V4.2.8.832C01450BA.

There is consequently no owner-accessible mechanism to change or disable the admin credential. Any guidance that directs users to set a password in the app does not address this vulnerability.

Proof of Concept

ffplay -rtsp_transport tcp rtsp://admin:admin@$IP_ADDRESS:554/video1

A successful run renders the device's live video stream, with no credential prompt and no owner-side approval.

Demonstration

Click the thumbnail to watch the recorded exploitation on YouTube.

Disclosure Timeline

Mitigation

No vendor patch is available as of 2026-08-05, and the admin credential cannot be changed by the device owner. Until a fix ships:

• Block inbound TCP/554 to the camera at the network edge.
• Place the camera on a segmented VLAN with no inbound route from untrusted networks, and reach it over a VPN rather than through port forwarding.
• Remove any existing port-forward rule for TCP/554 and disable UPnP on the perimeter router so the device cannot create one itself.

Setting the protection password in the Zosi Smart app is not a mitigation, for the reason given in Analysis §3.

A correct vendor fix requires provisioning the admin credential per device at first boot, or refusing RTSP connections until the owner has set a credential — not substituting one hard-coded value for another.

References

• Technical write-up and PoC: https://github.com/namaek2/CVE-2025-70962
• Demonstration video: https://youtu.be/fOgHo1jF8fQ
• CVE record: https://www.cve.org/CVERecord?id=CVE-2025-70962
• Vendor product page: https://eu.zositech.com/products/c519m-4k-indoor-wifi-pt-camera
• Vendor support hub for this model: https://supports.zositech.com/hc/en-us/categories/28435104244121-C519M
• Vendor firmware downloads: https://supports.zositech.com/hc/en-us/sections/34475932007577-Firmware-Downloads
• Related, same vulnerability class and identical CVSS vector: CVE-2025-65857 (Xiongmai XM530 IP cameras) — https://www.cve.org/CVERecord?id=CVE-2025-65857

Testing Note

All testing was performed on a device owned by the author, on an isolated network. This advisory is published so that owners and operators of the affected product can assess and mitigate their exposure. Accessing a camera you do not own or have written authorization to test is unlawful in most jurisdictions.