F16: Credentials embedded in ONVIF media URI (V3.5.2.1)

← All findings · Repository

Document type: local CVE candidate assessment, not a published CVE Record. CVE ID: unassigned. Product scope: Anpviz IPC-D240W-S V3.5.2.1 captured from the owner’s MCA40E camera; the V3.6.3.1 comparison image is an MCA50E image sent in error and was not flashed to this model.

Finding

The old URI builders insert administrator-derived material. The new snapshot URI is fixed; the stream URI can still contain it under shipped defaults.

Status in this image: original finding or lead.

Evidence limit: Live reachability and reuse of the returned credential material remain untested.

Classification and severity

• Proposed CWE: CWE-522, CWE-200
• CVSS v4.0 score: Not scored — current evidence does not support a defensible numeric impact/attack vector, this version lacks the issue, or the specific defect was fixed.
• CVSS v4.0 vector: Not assigned.
• Scoring basis: Live reachability and reuse of the returned credential material remain untested.
• CVE candidacy: Needs coordinator/CNA review for grouping, affected models and version status; do not equate this finding ID with a CVE ID.

Source screenshots

The PNGs are rendered, line-numbered excerpts of existing Ghidra C-like decompilation, not photographs of the Ghidra GUI or recovered vendor source. The original export is authoritative; image selection can omit relevant lines elsewhere in the function.

• F16: ONVIF media URI credentials — F16-GetSnapshotUri-old — V3.5.2.1/F16/F16-GetSnapshotUri-old.c lines 45–61; source SHA-256 1c1e4802c484722a1bce1fbdf0646c255b0eb6028be70aae72de0e37d53c1ca7.
• F16: ONVIF media URI credentials — F16-GetSnapshotUri-old — V3.5.2.1/F16/F16-GetSnapshotUri-old.c lines 59–75; source SHA-256 1c1e4802c484722a1bce1fbdf0646c255b0eb6028be70aae72de0e37d53c1ca7.
• F16: ONVIF media URI credentials — F16-GetSnapshotUri-old — V3.5.2.1/F16/F16-GetSnapshotUri-old.c lines 75–91; source SHA-256 1c1e4802c484722a1bce1fbdf0646c255b0eb6028be70aae72de0e37d53c1ca7.
• F16: ONVIF media URI credentials — F16-GetStreamUri-old — V3.5.2.1/F16/F16-GetStreamUri-old.c lines 34–50; source SHA-256 201c7509b23e180ba887e26426406288857c76231f50813ff34bb963215900b1.
• F16: ONVIF media URI credentials — F16-GetStreamUri-old — V3.5.2.1/F16/F16-GetStreamUri-old.c lines 86–102; source SHA-256 201c7509b23e180ba887e26426406288857c76231f50813ff34bb963215900b1.
• F16: ONVIF media URI credentials — F16-uri_680a4-old — V3.5.2.1/F16/F16-uri_680a4-old.c lines 36–52; source SHA-256 c2ac264f86a413082851328ecc896401b9421426183ee1d4660754aa5665036f.
• F16: ONVIF media URI credentials — F16-uri_680a4-old — V3.5.2.1/F16/F16-uri_680a4-old.c lines 87–103; source SHA-256 c2ac264f86a413082851328ecc896401b9421426183ee1d4660754aa5665036f.
• F16: ONVIF media URI credentials — F16-uri_68568-old — V3.5.2.1/F16/F16-uri_68568-old.c lines 46–62; source SHA-256 add6402450ca6ea4665b03d43cb8aba07f6ca5e6d1342cf496e331658dd7a081.
• F16: ONVIF media URI credentials — F16-uri_68568-old — V3.5.2.1/F16/F16-uri_68568-old.c lines 60–76; source SHA-256 add6402450ca6ea4665b03d43cb8aba07f6ca5e6d1342cf496e331658dd7a081.
• F16: ONVIF media URI credentials — F16-uri_68568-old — V3.5.2.1/F16/F16-uri_68568-old.c lines 76–92; source SHA-256 add6402450ca6ea4665b03d43cb8aba07f6ca5e6d1342cf496e331658dd7a081.

Related published CVEs

• No verified related CVE linked to this specific finding; this is not an exhaustive database search.

Case references

• Evidence index
• Initial public report
• Remediation review
• CERT/CC VRF #26-10-FZTVG; CISA Case #116607.

Source exports

• F16-GetSnapshotUri-old.c
• F16-GetStreamUri-old.c
• F16-uri_680a4-old.c
• F16-uri_68568-old.c