CVE-2019-11014

The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application (for Android, iOS, and Windows), do not prevent spoofing of the camera server. An attacker can create a fake camera server that listens for the client looking for a camera on the local network. When the camera responds to the client, it responds via the broadcast address, giving all information necessary to impersonate the camera. The attacker then floods the client with responses, causing the original camera to be denied service from the client, and thus causing the client to then communicate exclusively with the attacker's fake camera server. When connecting to the fake camera server, the client sends all details necessary to login to the camera (username and password).

• CWE-20

• http://blog.0x42424242.in/2019/03/vstarcam-investigational-security.htmlExploit, Third Party Advisory
• http://blog.0x42424242.in/2019/03/vstarcam-investigational-security_22.htmlExploit, Third Party Advisory
• http://blog.0x42424242.in/2019/03/vstarcam-investigational-security.htmlExploit, Third Party Advisory
• http://blog.0x42424242.in/2019/03/vstarcam-investigational-security_22.htmlExploit, Third Party Advisory

Published

Apr 8, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11008In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-…8.8
• CVE-2019-11009In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-…
• CVE-2019-1101An information disclosure vulnerability exists when the Wind…
• CVE-2019-11010In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memor…
• CVE-2019-11011Akamai CloudTest before 58.30 allows remote code execution.
• CVE-2019-11013Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory …
• CVE-2019-11015A vulnerability was found in the MIUI OS version 10.1.3.0 th…
• CVE-2019-11016Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redi…
• CVE-2019-11017On D-Link DI-524 V2.06RU devices, multiple Stored and Reflec…4.8
• CVE-2019-11018application\admin\controller\User.php in ThinkAdmin V4.0 doe…
• CVE-2019-11019Lack of authentication in case-exporting components in DDRT …7.5
• CVE-2019-1102A remote code execution vulnerability exists in the way that…