CVE-2026-38740

Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The device transmits sensitive Session Description Protocol (SDP), including ICE credentials and candidates, in cleartext over network interfaces. An attacker with network visibility can intercept these credentials to hijack media streams or authenticate to Foscam's TURN/relay infrastructure to forward arbitrary traffic at the vendor's expense.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/victorGoeman/Foscam-Security-Research/blob/main/CVE-2026-38740.md
https://github.com/victorGoeman/Foscam-Security-Research/blob/main/CVE-2026-38740.md

Configurations

No configuration.

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Foscam VD1 Video Doorbell anterior a la versión V5.3.13_1072 es vulnerable a la transmisión en texto claro de información sensible. El dispositivo transmite información sensible del protocolo de descripción de sesión (SDP), incluyendo credenciales y candidatos ICE, en texto claro a través de interfaces de red. Un atacante con visibilidad de red puede interceptar estas credenciales para secuestrar flujos de medios o autenticarse en la infraestructura TURN/relay de Foscam para reenviar tráfico arbitrario a expensas del proveedor.

Information

Published : 2026-05-14 19:16

Updated : 2026-10-19 22:10

NVD link : CVE-2026-38740

Mitre link : CVE-2026-38740

CVE.ORG link : CVE-2026-38740

JSON object : View

Products Affected

No product.

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2026-38740", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-38740", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T13:35:09.246843Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-14T19:16:32.903", "references": [{"url": "https://github.com/victorGoeman/Foscam-Security-Research/blob/main/CVE-2026-38740.md", "source": "cve@mitre.org"}, {"url": "https://github.com/victorGoeman/Foscam-Security-Research/blob/main/CVE-2026-38740.md", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The device transmits sensitive Session Description Protocol (SDP), including ICE credentials and candidates, in cleartext over network interfaces. An attacker with network visibility can intercept these credentials to hijack media streams or authenticate to Foscam's TURN/relay infrastructure to forward arbitrary traffic at the vendor's expense."}, {"lang": "es", "value": "Foscam VD1 Video Doorbell anterior a la versi\u00f3n V5.3.13_1072 es vulnerable a la transmisi\u00f3n en texto claro de informaci\u00f3n sensible. El dispositivo transmite informaci\u00f3n sensible del protocolo de descripci\u00f3n de sesi\u00f3n (SDP), incluyendo credenciales y candidatos ICE, en texto claro a trav\u00e9s de interfaces de red. Un atacante con visibilidad de red puede interceptar estas credenciales para secuestrar flujos de medios o autenticarse en la infraestructura TURN/relay de Foscam para reenviar tr\u00e1fico arbitrario a expensas del proveedor."}], "lastModified": "2026-10-19T22:10:00.130", "sourceIdentifier": "cve@mitre.org"}