Exacqvision stream hijacking: what do surveillance teams need to fix?

TL;DR: Nozomi Networks reports six vulnerabilities in Johnson Controls' exacqVision Web Service that can combine to hijack live video streams, steal authentication tokens, and bypass authentication, with affected versions up to 24.03 and a patched release in 24.06. The governance lesson is that surveillance integrity depends on browser-facing exposure, transport validation, and token handling being treated as one control surface, not separate problems.

Editorial analysis by NHI Mgmt Group, based on content published by Nozomi Networks: “Vulnerabilities in Johnson Controls' exacqVision Web Service Expose Security Systems to Video-Stream Hijacking”.

By the numbers:

• All products up to version 24.03 are affected by the issues.
• Nozomi Networks says the vulnerabilities are addressed in version 24.06 of exacqVision Web Service.

Key questions

Q: What breaks when a surveillance web service exposes authentication tokens?

A: When a browser-facing surveillance service leaks tokens, the login boundary no longer protects the control plane.

Q: Why do certificate validation failures make video hijacking possible?

A: Certificate validation tells a client whether the system it is talking to is really the expected endpoint.

Q: How should security teams test surveillance systems for feed integrity failures?

A: Teams should validate whether a live video feed can be altered without triggering an obvious operator warning, because that is the core failure mode here.

Practitioner guidance

• Audit browser-origin trust and token exposure Review CORS rules, browser session handling, and any endpoints that expose authentication tokens or session material to ensure a web origin cannot steal reusable access credentials.
• Validate camera-to-recorder certificates Enforce certificate validation on every RTSP path between cameras, recorders, and downstream applications so a network attacker cannot impersonate the source stream.
• Treat surveillance feeds as integrity-critical data Test whether operators can be shown a fabricated feed while the underlying camera continues recording correctly, and then close any path that permits feed substitution.

Bottom line: The exacqVision findings show how a surveillance platform can fail as both an access control surface and a source of operational truth.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →