Eyeplus has a flaw in the GetUsers function of the ONVIF Device component that allows an attacker to retrieve user account information from the device, potentially exposing usernames and passwords. The vulnerability can be triggered remotely via the ONVIF interface, letting a threat actor compromise the confidentiality of user credentials without requiring local access. This exposed data could be used for further lateral movement or unauthorized control of the device.

Eyeplus devices running firmware version 57.0.0.0308 are vulnerable. The affected component is the ONVIF Device service, specifically the GetUsers API endpoint. Devices with earlier or newer firmware that have not yet been patched are potentially unaffected, but the documented vulnerable version is 57.0.0.0308.

The CVSS score of 6.9 signals moderate severity, and the EPSS score is not available, so the current estimate of exploit probability is unknown. The vulnerability is not listed in the CISA KEV catalog, yet the exploit is publicly available, indicating that remote attackers can exploit it by accessing the ONVIF endpoint. Monitoring for unauthorized access and applying the vendor patch are the most effective mitigations.