TL;DR: Nozomi Networks reports six vulnerabilities in Johnson Controls' exacqVision Web Service that can combine to hijack live video streams, steal authentication tokens, and bypass authentication, with affected versions up to 24.03 and a patched release in 24.06. The governance lesson is that surveillance integrity depends on browser-facing exposure, transport validation, and token handling being treated as one control surface, not separate problems.
At a glance
What this is: Nozomi Networks found six vulnerabilities in exacqVision Web Service that can be chained to intercept credentials and tamper with live surveillance video.
Why it matters: This matters because surveillance platforms sit at the intersection of physical security and cyber control, so weak web-service hardening can undermine both access governance and operational trust.
By the numbers:
- All products up to version 24.03 are affected by the issues.
- Nozomi Networks says the vulnerabilities are addressed in version 24.06 of exacqVision Web Service.
Context
ExacqVision Web Service is a browser-accessible front end for remotely monitoring and managing surveillance systems, so its security posture directly affects both availability and trust in the footage it presents. When a web interface can expose authentication material or accept tampered streams, the problem is no longer just application security. It becomes a governance issue for physical security operations, because operators may act on a feed that no longer reflects reality.
The article shows how web-facing surveillance tooling can create a cross-domain risk surface: browser access, token handling, certificate validation, and stream integrity all matter at once. That makes the topic relevant to IAM and access governance as well as broader OT and critical infrastructure security, because compromise of the control plane can translate into a false sense of physical safety.
Key questions
Q: What breaks when a surveillance web service exposes authentication tokens?
A: When a browser-facing surveillance service leaks tokens, the login boundary no longer protects the control plane. An attacker can reuse the token to act as the legitimate user, bypass normal authentication, and reach functions that should have remained restricted. In practice, that turns a web interface into a privilege escalation path rather than a viewer.
Q: Why do certificate validation failures make video hijacking possible?
A: Certificate validation tells a client whether the system it is talking to is really the expected endpoint. If that check fails, a man-in-the-middle attacker can impersonate the camera or relay path and substitute another stream. The result is not only data theft but a false operational picture that can hide real-world activity.
Q: How should security teams test surveillance systems for feed integrity failures?
A: Teams should validate whether a live video feed can be altered without triggering an obvious operator warning, because that is the core failure mode here. The test should combine authentication, transport validation, and stream handling, then confirm that the visible feed always matches the source camera state and recording evidence.
Q: When does a camera management flaw become a physical security governance issue?
A: It becomes a governance issue when the flaw can change what operators believe is happening in the physical environment. At that point, the system is no longer just a technical tool with a bug. It is influencing decisions about access, intrusion detection, and incident response, so ownership has to extend beyond IT alone.
Technical breakdown
How insecure CORS exposes authentication tokens
Cross-Origin Resource Sharing, or CORS, defines which web origins may interact with a service from a browser context. If that policy is too permissive, a malicious site can trick a victim's browser into making requests that should not be allowed, which can expose authentication material such as tokens. In a browser-managed admin interface, this matters because token theft does not require direct server compromise. It only needs a trust boundary that is too wide. Once the token is obtained, the attacker can act as the authenticated user or session holder.
Practical implication: lock down browser-origin trust and review any workflow that lets a web interface expose reusable authentication tokens.
Why certificate validation failures enable RTSP hijacking
Real-Time Streaming Protocol, or RTSP, is commonly used to move video from cameras into monitoring systems. If the receiving service does not properly validate certificates, a man-in-the-middle attacker on the network path can impersonate the camera or proxy the stream. That allows arbitrary content to be injected into what operators believe is a live feed. The technical failure is not just encryption in transit. It is the absence of trust verification for the endpoint that claims to be the source of the stream. In surveillance environments, that means the integrity of evidence can be altered without obvious application errors.
Practical implication: enforce certificate validation on every camera-to-recorder path and treat stream integrity as a security requirement, not a quality setting.
How combined web flaws turn a monitor into a false source of truth
The article's six issues are powerful because they compose. One flaw can expose access material, another can bypass authentication, and another can let an attacker replace the RTSP feed with fabricated content. That combination shifts the impact from isolated application weakness to operational deception. For operators, the dangerous outcome is not merely unauthorized access. It is decision-making based on a feed that appears legitimate while hiding activity in the physical environment. In surveillance systems, integrity is as important as confidentiality, because a trusted lie can be more damaging than a visible outage.
Practical implication: assess surveillance platforms as integrity systems and test whether chained flaws could let an attacker alter what operators see.
Threat narrative
Attacker objective: The attacker wants to hide physical activity by replacing a real surveillance feed with a fake one while retaining unauthorized access to the system.
- Entry begins with network-reachable web service weaknesses, including permissive cross-domain policy and weak request handling, that let an attacker interact with the interface in ways the operator did not intend.
- Credential access follows when insecure CORS handling can expose authentication tokens and related access material, creating a path to bypass the normal login boundary.
- Escalation occurs when certificate validation failures let a man-in-the-middle attacker intercept the RTSP session and inject arbitrary video content into the stream.
- Impact is surveillance deception, where operators see a fabricated feed instead of the real scene and may miss intrusion, tampering, or theft.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Surveillance platforms are identity and integrity systems, not just cameras with software. Once a web service can expose tokens and accept unverified streams, the control problem extends beyond device management into access governance. The system must prove who is allowed to request the feed and what endpoint is allowed to supply it. Practitioners should treat surveillance interfaces as privileged operational tools, not passive display layers.
This incident illustrates a trust-boundary collapse between browser access and stream authenticity. The article's core failure mode is not a single bug, but the assumption that web authentication, cross-origin policy, and transport validation can be assessed separately. In practice, those controls form one chain, and the weakest link determines whether an operator sees reality or a crafted substitute. The field should name this as surveillance feed integrity failure.
Video management systems now sit close to access control, incident response, and physical security decisions. That makes them governance-sensitive even when the exploit begins in ordinary web code. Organisations that separate IT patching from physical security oversight will miss the combined risk of access token exposure and stream tampering. The right programme view is cross-functional ownership of surveillance integrity.
OWASP-NHI is not the only lens here, but identity governance still matters because stolen tokens function like non-human credentials. When an interface hands out authentication material that can be reused elsewhere, the issue resembles NHI secret leakage and over-privilege even in a device context. Teams should inventory which operational systems mint reusable access material and verify that issuance, scope, and revocation are controlled like any other privileged credential.
The strongest lesson for critical infrastructure is that 'monitoring' tools can become deception tools. If an attacker can change what an operator believes is happening, then detection time, response quality, and evidentiary reliability all degrade together. Practitioners should re-evaluate whether their surveillance platforms are covered by the same risk model as other privileged management planes.
What this signals
Surveillance integrity is now a governance problem, not only an application problem. Once a web service can expose access tokens and allow stream substitution, physical security teams inherit a cyber control issue that affects how incidents are seen and acted on. Programmes should assess whether monitoring platforms are subject to the same access review and revocation discipline as other privileged systems.
Feed tampering is the named concept practitioners should track. It describes the condition where an operator receives an apparently valid but manipulated video source, creating a blind spot in the control room. That failure mode cuts across application security, network trust, and physical response, so it belongs in combined cyber-physical risk reviews.
Browser-facing surveillance tools need stricter trust boundaries than ordinary internal apps. If authentication material, cross-origin policy, and transport verification are handled casually, the resulting exposure can let an attacker both enter the system and falsify what the system reports. Teams should review these platforms as privileged management planes with evidence integrity requirements.
For practitioners
- Audit browser-origin trust and token exposure Review CORS rules, browser session handling, and any endpoints that expose authentication tokens or session material to ensure a web origin cannot steal reusable access credentials.
- Validate camera-to-recorder certificates Enforce certificate validation on every RTSP path between cameras, recorders, and downstream applications so a network attacker cannot impersonate the source stream.
- Treat surveillance feeds as integrity-critical data Test whether operators can be shown a fabricated feed while the underlying camera continues recording correctly, and then close any path that permits feed substitution.
- Prioritise patching to the fixed release Move affected exacqVision Web Service instances to version 24.06 and confirm that vulnerable versions up to 24.03 are removed from the estate.
Key takeaways
- The exacqVision findings show how a surveillance platform can fail as both an access control surface and a source of operational truth.
- Six vulnerabilities were enough to enable token theft, authentication bypass, and RTSP stream hijacking in affected versions through 24.03.
- Patching to the fixed release is necessary, but governance teams also need to test whether operators could be shown a believable false feed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Permissive cross-domain policy and weak trust handling are central misconfiguration issues in the web service. |
| API2 — Broken Authentication | Stolen authentication tokens and bypassed login controls are core to the exploit chain described. | |
| Recommendation — Audit API and web-service trust boundaries for misconfiguration that lets browsers or clients bypass intended controls. Harden authentication flows so exposed tokens cannot be reused to bypass normal access checks. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on whether access material and remote monitoring functions are properly restricted. |
| Recommendation — Review entitlements for surveillance management interfaces and remove any access path that exceeds operational need. | ||
| CIS Controls v8 | CIS-5 — Account Management | Compromised tokens and administrative access make account governance and revocation central to the response. |
| Recommendation — Use account-management controls to revoke exposed access material and verify no stale privileged sessions remain. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | The exploit chain includes token theft followed by operational deception of the monitoring system. |
| Recommendation — Map token exposure and feed manipulation to Credential Access and Impact when hunting for similar abuse paths. | ||
Key terms
- Cross-Origin Resource Sharing: CORS is a browser security control that decides whether one origin may read responses from another origin. It does not authenticate users or protect servers by itself. Instead, it governs which browser-based requests may be exposed to JavaScript after the server returns a response.
- Man-in-the-Middle Attack: A man-in-the-middle attack is an interception technique where an attacker positions themselves between two parties that believe they are communicating directly. The attacker can read, alter, or replay traffic, which makes the attack especially dangerous when credentials, sessions, or certificates are involved.
- RTSP Stream Hijacking: RTSP stream hijacking is the interception or substitution of a real-time video feed carried over the Real-Time Streaming Protocol. The risk is not just confidentiality loss. It is integrity failure, where the monitoring system displays content that no longer matches the underlying camera source.
- Access Token: An access token is a credential that authorises a client or user to call a service or API for a limited time and with specific permissions. Attackers steal tokens to bypass passwords and multi-factor checks, so defenders should limit token scope and lifetime, protect storage, and revoke tokens after compromise.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management for practitioners who need to govern privileged access across complex environments. It gives identity and security teams a shared baseline for controlling credentials, rotation, and lifecycle risk.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org