Two iCam365 security camera models are vulnerable to unauthenticated access that could expose live video feeds and device configurations, the U.S. Cybersecurity and Infrastructure Security Agency warned this week. The camera maker, iCam365, did not respond to CISA's coordination attempts, meaning no firmware patch is in sight.
The Flaws: Unlocked Video and Control
According to CISA's advisory (ICSA-25-324-02), the affected cameras are the ROBOT PT Camera P201 and the Night Vision Camera QC021. Both run firmware version 43.4.0.0 or earlier. Two separate but related vulnerabilities—CVE-2025-64770 and CVE-2025-62674—stem from a missing authentication mechanism for critical functions. In plain terms, anyone on the same network can tap into the camera’s Open Network Video Interface Forum (ONVIF) services or pull a live Real Time Streaming Protocol (RTSP) stream without providing any password.
The ONVIF flaw means an attacker could read camera configuration details, potentially including network settings, NVR credentials, or motion-detection schedules. In some implementations, unauthenticated ONVIF access might also allow pan-tilt-zoom control or preset manipulation. The RTSP flaw allows anyone with network access to view the camera’s live video feed without credentials—simply by connecting to port 554.
Both vulnerabilities carry CVSS v3.1 scores of 6.8 and CVSS v4 scores of 7.0. Crucially, the attack vector is listed as adjacent network (AV:A), not remote (AV:N). That means these flaws are not directly exploitable from the internet under default configurations—an attacker would need to be on the same local network segment, either physically or via a compromised device. However, if you’ve intentionally exposed your camera’s management interface or RTSP port to the internet through port forwarding or a VPN with weak access controls, the risk becomes remote.
Who’s at Risk and What’s Really at Stake
iCam365 markets these cameras globally for small businesses and home use. The P201 is a pan-tilt model; the QC021 is a night-vision camera. Both connect to a mobile app for management and cloud features. While a home user might not be a high-value target, an unauthenticated video feed could be accessed by a guest on your Wi-Fi or by malware already on a PC on your network. For businesses, the stakes are higher: cameras in retail, warehouses, or offices could reveal sensitive operations. Stolen configuration data might expose credentials for network video recorders (NVRs), which often run on Windows servers.
Windows administrators should pay close attention. Many NVR and video management software (VMS) packages run on Windows Server or Windows 10/11 machines. If a camera sits on the same network segment as a Windows NVR, an attacker could use the camera as a pivot point to scan for open RDP ports, administrative shares, or other Windows services. Hardening the entire camera-to-NVR chain is essential.
A Pattern of Unauthenticated Access in Camera Ecosystems
This isn’t the first time CISA has flagged unauthenticated access in IP cameras. Over the past two years, similar advisories have hit Ubox, Survision, PTZOptics, and others. The problem is systemic: low-cost camera hardware ships with open services, default credentials, or cloud-relay mechanisms that trust any request. Manufacturers often prioritize easy setup over security, and many users never change default settings. When a vendor fails to respond to CISA—as iCam365 did here—the security burden falls entirely on the user.
The camera industry’s reliance on ONVIF and RTSP as standards means these protocols are everywhere. ONVIF is designed for discovery and control; RTSP is for streaming. Both are supposed to require authentication, but implementations vary wildly. A 2023 study by security researchers found that over 30% of ONVIF-scanning queries on the public internet receive unauthenticated responses, indicating widespread misconfiguration or inherent flaws. The iCam365 case fits right into that troubling statistic.
Immediate Actions for Home Users and Windows Administrators
There is no firmware update to fix these bugs, at least not yet. Until iCam365 releases a patch—and given its silence, that may never happen—you must rely on network-level defenses. Here’s what you should do right now, prioritized by urgency.
1. Inventory Your Cameras
Locate every iCam365 P201 and QC021 on your network. Note their IP addresses, MAC addresses, firmware versions, and physical locations. On Windows, you can use the arp -a command or tools like Advanced IP Scanner to find devices. For ONVIF discovery, try ONVIF Device Manager (a free Windows tool) to see if cameras respond. Check your router’s UPnP settings—many routers automatically forward ports for IoT devices. Disable UPnP if it’s not strictly needed, to prevent accidental exposure.
2. Remove Internet Exposure Immediately
If you’ve set up port forwarding to access your camera remotely, disable those rules now. Block inbound traffic to ports commonly used by cameras: HTTP (80), HTTPS (443), ONVIF (often 8080, 5000, or 3702), and RTSP (554). If you must have remote access, use a hardened VPN with multi-factor authentication, and never forward ports directly to the camera. For home users, log in to your router and ensure no port forwarding rules exist for the camera’s IP. Disable any DMZ or port triggering settings. If your router supports it, create a separate guest network for IoT devices—this at least isolates your cameras from your main PCs and NAS devices.
3. Isolate Cameras on a Dedicated VLAN
For business environments, place all cameras on a separate VLAN with strict access control lists (ACLs). Allow only the NVR server (and any authorized management workstation) to communicate with them. Block camera-initiated connections to the internet unless absolutely necessary, and then only to known vendor cloud endpoints. This segmentation significantly limits lateral movement if a camera is compromised.
4. Disable Unused Services
If you don’t use ONVIF for third-party integration, disable it in the camera’s settings. Similarly, if RTSP isn’t required by your NVR, turn it off. Many cameras allow you to disable these protocols via their web interface or mobile app. Less attack surface always means less risk.
5. Strengthen Authentication Everywhere
Even though the vulnerability allows unauthenticated access, you should still set strong, unique passwords for each camera’s admin account. Change any default usernames. For Windows NVR software, apply the principle of least privilege: run the NVR service under a dedicated user account, not with administrative rights, and enable Windows firewall to restrict incoming connections.
6. Monitor for Suspicious Activity
Enable logging on your cameras and NVR if possible. On Windows, use Event Viewer combined with network monitoring tools to watch for unexpected RTSP or ONVIF traffic. Set up alerts for any unauthorized configuration changes, new admin accounts, or unexpected outbound connections from the camera VLAN. On a Windows NVR, look for event ID 5156 (allowed connection) in the Windows Firewall log and filter for ports 554 or 8080. You can also use PowerShell to monitor new network connections: Get-NetTCPConnection | Where-Object {$_.RemotePort -eq 554}. A free tool like Wireshark can help you spot anomalous traffic.
7. Plan for Replacement or Compensating Controls
If these cameras are deployed in high-security areas and no patch materializes, start planning to replace them with more secure models. When evaluating new cameras, demand secure-by-default features: forced password changes on first boot, signed firmware updates, and a vendor vulnerability disclosure policy. For now, treat the iCam365 devices as untrusted endpoints on your network.
What to Watch Next
At the time of writing, the two CVEs assigned to these vulnerabilities do not yet appear in public registries like MITRE or the National Vulnerability Database. That’s not unusual—indexing can lag behind advisory publication. Security teams managing vulnerability scanners should manually add the CISA advisory as a reference and monitor NVD for official entries over the coming weeks.
The bigger picture is harder to fix. Low-cost cameras will likely continue to ship with insecure defaults. As long as consumers and businesses buy on price alone, vendors have little incentive to invest in security. The iCam365 advisory is a reminder that when you plug a cheap camera into your network, you’re also plugging in a potential surveillance hole. Until the industry shifts toward mandatory authentication and responsible disclosure, the best defense is a well-architected network and a healthy dose of skepticism toward any device that promises convenience without asking for a password.
For Windows professionals, this incident underscores the importance of treating cameras as potential entry points. Segment them away from your domain controllers, apply your Windows hardening standards to the NVR, and never assume that a camera’s built-in security is sufficient. The risks may be local, but the consequences can spread quickly across a flat network.