CVE-2025-70962 Zosi CVE debrief

Who should care

Security teams and administrators responsible for managing Zosi C519M V4.2.8.823C01450BA devices should be aware of this vulnerability and take necessary actions to mitigate it. This includes verifying the presence of the device in the network, implementing compensating controls to restrict access to the RTSP video stream, and monitoring for any suspicious activity related to the RTSP video stream. Additionally, security teams should consider upgrading to a newer version of the device firmware, if available, to address the vulnerability. IT teams and network administrators should also be aware of this vulnerability and work with security teams to implement necessary mitigations. Furthermore, incident response teams should be prepared to respond to potential exploitation of this vulnerability. Compliance teams should also review the vulnerability and ensure that necessary controls are in place to meet regulatory requirements. Auditors should review the vulnerability and verify that necessary controls are in place to mitigate the vulnerability. Penetration testers and red teamers should also be aware of this vulnerability and test for it during their assessments. Blue teamers and defenders should be aware of this vulnerability and monitor for potential exploitation. Threat hunters should also be aware of this vulnerability and monitor for potential exploitation. Security architects should review the vulnerability and ensure that necessary controls are in place to mitigate the vulnerability. Risk managers should review the vulnerability and assess the risk associated with it. Compliance officers should review the vulnerability and ensure that necessary controls are in place to meet regulatory requirements. Legal teams should review the vulnerability and ensure that necessary controls are in place to mitigate the vulnerability. Vendor management teams should review the vulnerability and ensure that necessary controls are in place to mitigate the vulnerability. Cyber insurance teams should review the vulnerability and assess the risk associated with it. Incident response teams should review the vulnerability and ensure that necessary controls are in place to respond

Technical summary

The Zosi C519M V4.2.8.823C01450BA device is vulnerable to Incorrect Access Control due to hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized viewing of camera footage. The vulnerability is caused by the presence of hardcoded credentials, which cannot be changed by the user. This allows an attacker to easily access the RTSP video stream and view camera footage without authorization.

Defensive priority

High-priority defensive actions are required to address the vulnerability. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity.

Recommended defensive actions

• Inventory and verify the presence of Zosi C519M V4.2.8.823C01450BA devices in the network.
• Implement compensating controls to restrict access to the RTSP video stream.
• Monitor for any suspicious activity related to the RTSP video stream.
• Consider upgrading to a newer version of the device firmware, if available.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by hardcoded credentials in the RTSP authentication mechanism of Zosi C519M V4.2.8.823C01450BA. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized viewing of camera footage. Evidence is limited, and further verification is required to determine the full scope of the vulnerability.

Official resources