A flaw in Eyeplus firmware version 57.0.0.0308 allows remote attackers to retrieve sensitive snapshot information through an unprotected /snapshot endpoint in the p2pcam Service. This leads to disclosure of potentially confidential or proprietary images and associated metadata, representing a violation of confidentiality. The weakness maps to CWE‑200 (Information Exposure) and CWE‑284 (Improper Authorization).

The affected system is Eyeplus hardware running firmware version 57.0.0.0308, where the p2pcam Service component includes the vulnerable /snapshot function. Only this specific version has been confirmed; no additional versions were identified.

The CVSS score of 6.9 reflects a moderate severity. EPSS is not available, so the current probability of exploitation cannot be quantified, but the vulnerability has an existing published exploit and can be triggered remotely without authentication. The issue is not listed in CISA KEV, yet its remote nature and lack of authentication requirements make it a potential target for attackers. The attack vector is inferred to be network‑based, exploiting the exposed service over the device’s management or camera interface.