A critical vulnerability in the FLIR Brickstream 3D+ sensor allows unauthenticated remote attackers to access live video streams, posing a significant privacy and security risk.

This is a missing authentication for a critical function vulnerability (CWE-306). Remote, unauthenticated attackers can retrieve sensitive video imagery by directly querying unprotected endpoints such as middleImage.jpg and rightimage.jpg.

The exposure of live video feeds from physical security sensors can lead to unauthorized surveillance of sensitive areas, including retail stores, banks, and transportation terminals. This unauthorized access compromises privacy, facilitates physical security reconnaissance, and presents a severe risk of reputational damage and regulatory non-compliance. Given the CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized data exfiltration.

Immediate Action: Update the firmware and associated software components of the FLIR Brickstream 3D+ sensor to the latest available version provided by the manufacturer.

Proactive Monitoring: Inspect network traffic logs for unauthorized GET requests targeting image endpoints on these devices and monitor for unusual spikes in bandwidth consumption.

Compensating Controls: Isolate the affected devices on a restricted management VLAN and implement strict firewall rules to block external access to the device management interface.

Public Exploit Available: Yes, a functional proof-of-concept script is available via the Exploit Database (EDB-ID: 45607).

The ability for an unauthenticated user to access live video streams constitutes a major security failure that must be addressed immediately. Organizations currently deploying FLIR Brickstream 3D+ sensors should verify their firmware versions and apply all available security updates. Until patches are verified and applied, restricted network access is the most effective method to mitigate the risk of unauthorized stream exposure.