CVE-2026-50245: Brickcom Camera Unauthenticated ONVIF Snapshot Access Vulnerability

Technical summary

CVE-2026-50245 is an authentication bypass vulnerability affecting Brickcom network cameras. The /ONVIF endpoint fails to implement proper access controls (CWE-306: Missing Authentication for Critical Function), permitting unauthenticated requests to retrieve still images from the live camera feed. The CVSS 3.1 score of 7.7 (HIGH) reflects the local attack vector requirement but acknowledges significant confidentiality impact—an attacker can enumerate and exfiltrate surveillance imagery without credentials or privilege escalation.

Business impact

Organizations deploying Brickcom cameras for physical security, access control monitoring, or compliance-mandated surveillance face unauthorized disclosure of sensitive visual data. An insider or lateral-movement attacker can silently exfiltrate camera feeds, potentially exposing facility layouts, employee movements, visitor patterns, or other surveillance content without detection. This creates both operational security and regulatory risk, especially in industries subject to data protection or facility security requirements.

Affected systems

Brickcom IP cameras with network connectivity are affected. The published advisory does not specify particular model numbers or firmware versions; organizations using Brickcom equipment should consult the vendor's security notice for precise affected product lines and scope. Devices accessible via the /ONVIF endpoint on the local network are at risk.

Exploitability

Exploitation requires local network access (Brickcom cameras must be reachable on the attacker's network segment). No authentication, credentials, or user interaction is needed once network access is established. The attack is straightforward: issue HTTP requests to the /ONVIF endpoint and retrieve image data. Because the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, widespread active exploitation in the wild is not yet confirmed, but the low technical barrier suggests rapid weaponization is plausible if attack code emerges.

Remediation

Contact Brickcom for updated firmware that enforces authentication on the /ONVIF endpoint and all image retrieval functions. In parallel, implement network segmentation to isolate camera infrastructure on a dedicated VLAN with restricted access from general workstations. Apply access control lists (ACLs) at network perimeter and internal switches to limit which hosts can reach camera systems. Audit existing camera access logs for signs of unauthorized snapshot retrieval. Verify remediation by attempting unauthenticated access to the /ONVIF endpoint after patching.

Patch guidance

Check Brickcom's official security advisories for patched firmware versions specific to your camera models. Apply patches in a controlled manner: test in a non-production environment first, schedule maintenance windows to minimize surveillance gaps, and verify that camera functionality and ONVIF compliance are restored post-patch. If the vendor has not yet published patches, request an estimated timeline and implement compensating controls (network isolation, access restrictions) immediately.

Detection guidance

Monitor network traffic for unauthenticated HTTP requests to the /ONVIF endpoint on camera systems. Log and alert on any snapshot or image retrieval attempts that bypass normal authentication flows. Review camera access logs for entries showing image requests from unexpected source IPs or during off-hours. Intrusion detection systems (IDS) configured with rules for ONVIF protocol abuse may detect lateral reconnaissance targeting cameras. Baseline normal camera access patterns and flag anomalies.

Why prioritize this

This vulnerability merits prompt attention because it enables passive, difficult-to-detect exfiltration of sensitive surveillance data. The high CVSS score reflects substantial confidentiality impact and ease of exploitation once network access is present. Although KEV status is not yet assigned, the straightforward nature of the attack and the growing visibility of supply-chain or insider threats elevate risk. Organizations with critical physical security or privacy-sensitive surveillance should prioritize patching and network controls above less critical assets.

Risk score, explained

CVSS 3.1 score of 7.7 (HIGH) is driven by high confidentiality impact (C:H), high integrity impact (I:H), and no availability impact (A:N), balanced against a local attack vector (AV:L) and low complexity (AC:L). The presence of integrity impact may reflect potential for snapshot tampering or man-in-the-middle scenarios. The local scope (S:U) means the attacker cannot escalate privileges outside the camera system itself, but unauthorized image access alone justifies the HIGH severity rating.

Frequently asked questions