CVE-2019-25236
Published: 24 December 2025
Description
iSeeQ Hybrid DVR WH-H4 1.03R contains an unauthenticated vulnerability in the get_jpeg script that allows unauthorized access to live video streams. Attackers can retrieve video snapshots from specific camera channels by sending requests to the /cgi-bin/get_jpeg endpoint without authentication.
Mitigating Controls (NIST 800-53 r5)AI
AC-14 explicitly identifies and limits user actions performable without identification or authentication, directly addressing the unauthenticated access to the get_jpeg endpoint exposing live video streams.
AC-3 enforces approved authorizations for access to system resources, mitigating the lack of enforcement on the critical get_jpeg script.
AC-22 controls access to and protects publicly accessible content, preventing unauthorized retrieval of sensitive video snapshots via the exposed endpoint.
Security SummaryAI
CVE-2019-25236 is an unauthenticated vulnerability in the get_jpeg script of the iSeeQ Hybrid DVR WH-H4 version 1.03R. It enables unauthorized access to live video streams, allowing attackers to retrieve video snapshots from specific camera channels by sending requests to the /cgi-bin/get_jpeg endpoint without any authentication. The issue is classified under CWE-306 (Missing Authentication for Critical Function) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to high impacts on confidentiality, integrity, and availability.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low attack complexity. By crafting and sending HTTP requests to the exposed endpoint, they can directly access sensitive live video feeds from targeted camera channels, potentially enabling surveillance monitoring, privacy violations, or further reconnaissance for additional attacks on the DVR system.
References include the vendor site at http://www.iseeq.co.kr, an Exploit-DB entry (https://www.exploit-db.com/exploits/47562) providing a proof-of-concept, and a Zero Science Labs advisory (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5539.php). These detail the vulnerability but do not specify patches or mitigations in the available information.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated access to live video snapshots via public-facing CGI endpoint enables T1190 (Exploit Public-Facing Application) and facilitates T1125 (Video Capture) by providing direct unauthorized retrieval of camera surveillance footage.