Topic starter
24/10/2026 8:46 pm
TL;DR: RTSP stream hijacking, token theft and authentication bypass were all possible in exacqVision Web Service, according to Nozomi Networks. Surveillance feeds need transport checks and token handling treated as one trust path, or operators may see a believable false picture.
Editorial analysis by NHI Mgmt Group, based on content published by Nozomi Networks: “Vulnerabilities in Johnson Controls' exacqVision Web Service Expose Security Systems to Video-Stream Hijacking”.
By the numbers:
- All products up to version 24.03 are affected by the issues.
- Nozomi Networks says the vulnerabilities are addressed in version 24.06 of exacqVision Web Service.
Key questions
Q: Why do certificate validation failures make video hijacking possible?
A: Certificate validation tells a client whether the system it is talking to is really the expected endpoint.
Q: How should security teams test surveillance systems for feed integrity failures?
A: Teams should validate whether a live video feed can be altered without triggering an obvious operator warning, because that is the core failure mode here.
Q: What breaks when a surveillance web service exposes authentication tokens?
A: When a browser-facing surveillance service leaks tokens, the login boundary no longer protects the control plane.
Practitioner guidance
- Audit browser-origin trust and token exposure Review CORS rules, browser session handling, and any endpoints that expose authentication tokens or session material to ensure a web origin cannot steal reusable access credentials.
- Validate camera-to-recorder certificates Enforce certificate validation on every RTSP path between cameras, recorders, and downstream applications so a network attacker cannot impersonate the source stream.
- Treat surveillance feeds as integrity-critical data Test whether operators can be shown a fabricated feed while the underlying camera continues recording correctly, and then close any path that permits feed substitution.
Bottom line: The exacqVision findings show how a surveillance platform can fail as both an access control surface and a source of operational truth.
Glossary terms: Cross-Origin Resource Sharing, Man-in-the-Middle Attack, RTSP Stream Hijacking, Access Token
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Surveillance platforms are identity and integrity systems, not just cameras with software. Once a web service can expose tokens and accept unverified streams, the control problem extends beyond device management into access governance. The system must prove who is allowed to request the feed and what endpoint is allowed to supply it. Practitioners should treat surveillance interfaces as privileged operational tools, not passive display layers.
A question worth separating out:
Q: When does a camera management flaw become a physical security governance issue?
A: It becomes a governance issue when the flaw can change what operators believe is happening in the physical environment. At that point, the system is no longer just a technical tool with a bug. It is influencing decisions about access, intrusion detection, and incident response, so ownership has to extend beyond IT alone.
👉 Read our full editorial: Exacqvision web service flaws can hijack video streams
This post was modified 6 days ago by NHI Mgmt Group