CVE-2019-3948

CVE-2019-3948 describes an authentication bypass vulnerability in various Amcrest and Dahua IP cameras and NVRs. Specifically, these devices do not require authentication to access the /videotalk HTTP endpoint. This allows an unauthenticated, remote attacker to connect to this endpoint and potentially listen to the audio captured by the device. The vulnerability has a CVSS v3 score of 7.5 (High), indicating a critical risk due to its network-based attack vector and low attack complexity, leading to a high impact on confidentiality. While not listed in CISA's KEV catalog, an exploit module for Amcrest cameras is available on ExploitDB. Despite the public exploit, there is minimal community discussion or media coverage surrounding this CVE.