---
id: CVE-2025-70962
title: Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control
summary: >-
  Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The
  application contains hardcoded credentials in the RTSP authentication
  mechanism. An attacker with network access can use the unchangeable default
  credentials to…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-284
published: '2026-08-05'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:04:24.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-70962'
references:
  - url: 'https://github.com/namaek2/CVE-2025-70962'
    label: cve@mitre.org
  - url: 'https://www.zositech.com/'
    label: cve@mitre.org
  - url: 'https://github.com/namaek2/CVE-2025-70962'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-05T19:29:08.754396Z'
ingestedAt: '2026-09-10T19:37:42.564Z'
epss: 0.00504
epssPercentile: 0.40422
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/namaek2/CVE-2025-70962'
  checkedAt: '2026-09-25T08:20:48.426Z'
---

## Overview

Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized viewing of camera footage.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.