Brickcom cameras expose a critical function that allows unauthenticated retrieval of live and still images via the /ONVIF endpoint. By accessing this endpoint without credentials, an attacker can view camera snapshots, effectively compromising the confidentiality of internal footage. This vulnerability reflects improper authentication (CWE-306).

The flaw impacts Brickcom Box, Bullet, Cube, and Dome camera models. No specific firmware or serial version details are supplied, therefore all devices listed are presumed vulnerable until a vendor update is released.

The CVSS score of 8.3 signals a high severity risk, while the EPSS score is unavailable, indicating uncertainty about current exploitation trends. The flaw is not recorded in CISA’s KEV catalog, so no public exploits are known. Attackers can exploit the vulnerable endpoint over the network, requiring only connectivity to the camera. The likely attack vector is network-based, necessitating no special conditions beyond access to the device’s service port.