This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.
Description
When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled.
A vulnerability exists in WolfVision devices with the vSolution Matrix feature enabled, allowing current screen content to be transmitted via an unauthenticated RTSP/RTP stream to hosts on the same network segment. This unencrypted stream could be intercepted by an unauthenticated host, potentially exposing presentation content, including confidential information, where network access is not otherwise restricted.
Users of Cynap Pro and Cynap Core Pro devices should update to firmware version v1.78a. For Cynap and Cynap Core models, which will not receive a firmware update, it is recommended to decommission the device when feasible or restrict access to trusted hosts and networks. Until the update is applied, the vSolution Matrix feature can be disabled if not needed, or access can be restricted to networks with only trusted Matrix stations. If network separation is not possible, certain ports can be blocked on the firewall to prevent unauthorized access to the unencrypted RTSP stream.
Disable the "vSolution Matrix" feature if it is not required.
Mitigation:low effort
Restrict vSolution Matrix to networks that contain only trusted Matrix stations.
Mitigation:low effort
If network separation is not feasible, block the following on a firewall:
- Inbound RTSP control: TCP 554 and 8554. The device redirects TCP 554 to 8554, and Matrix clients connect to 8554.
- Outbound audio and video multicast from the device: UDP 5500-5503 by default.
- On Cynap Core and on Cynap Pro, also block inbound TCP 555 and 8555 and outbound UDP 5504-5507. These ports carry the second HDMI stream.
- If the multicast port base is not 5500, replace 5500-5503 with that base through base+3, and 5504-5507 with base+4 through base+7.
WolfVision Cynap Core Pro
< v1.78a
CPE
No CPEs found in CPE dictionary for this product.
Remediation
Upgrade: v1.78amoderate effort
Workaround:low effort
Disable the "vSolution Matrix" feature if it is not required.
Mitigation:low effort
Restrict vSolution Matrix to networks that contain only trusted Matrix stations.
Mitigation:low effort
If network separation is not feasible, block the following on a firewall:
- Inbound RTSP control: TCP 554 and 8554. The device redirects TCP 554 to 8554, and Matrix clients connect to 8554.
- Outbound audio and video multicast from the device: UDP 5500-5503 by default.
- On Cynap Core and on Cynap Pro, also block inbound TCP 555 and 8555 and outbound UDP 5504-5507. These ports carry the second HDMI stream.
- If the multicast port base is not 5500, replace 5500-5503 with that base through base+3, and 5504-5507 with base+4 through base+7.
WolfVision Cynap
All versions
CPE
cpe:2.3:a:wolfvision:cynap:*:*:*:*:*:*:*:*
Remediation
Workaround:low effort
Disable the "vSolution Matrix" feature if it is not required.
Mitigation:low effort
Restrict vSolution Matrix to networks that contain only trusted Matrix stations.
Mitigation:low effort
If network separation is not feasible, block the following on a firewall:
- Inbound RTSP control: TCP 554 and 8554. The device redirects TCP 554 to 8554, and Matrix clients connect to 8554.
- Outbound audio and video multicast from the device: UDP 5500-5503 by default.
- On Cynap Core and on Cynap Pro, also block inbound TCP 555 and 8555 and outbound UDP 5504-5507. These ports carry the second HDMI stream.
- If the multicast port base is not 5500, replace 5500-5503 with that base through base+3, and 5504-5507 with base+4 through base+7.
WolfVision Cynap Core
All versions
CPE
No CPEs found in CPE dictionary for this product.
Remediation
Workaround:low effort
Disable the "vSolution Matrix" feature if it is not required.
Mitigation:low effort
Restrict vSolution Matrix to networks that contain only trusted Matrix stations.
Mitigation:low effort
If network separation is not feasible, block the following on a firewall:
- Inbound RTSP control: TCP 554 and 8554. The device redirects TCP 554 to 8554, and Matrix clients connect to 8554.
- Outbound audio and video multicast from the device: UDP 5500-5503 by default.
- On Cynap Core and on Cynap Pro, also block inbound TCP 555 and 8555 and outbound UDP 5504-5507. These ports carry the second HDMI stream.
- If the multicast port base is not 5500, replace 5500-5503 with that base through base+3, and 5504-5507 with base+4 through base+7.
Volerion