Unauthorized Access to vSolution Matrix RTSP

Overview

When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled.

Affected

• cynap_pro_cynap_core_pro < 1.78a

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Workarounds

Until an update can be applied, consider the following measures where operationally feasible:

• Disable the "vSolution Matrix" feature if it is not required.
• Restrict vSolution Matrix to networks that contain only trusted Matrix stations.

If network separation is not feasible, block the following on a firewall: * Inbound RTSP control: TCP 554 and 8554. The device redirects TCP 554 to 8554, and Matrix clients connect to 8554.

• Outbound audio and video multicast from the device: UDP 5500-5503 by default.
• On Cynap Core and on Cynap Pro, also block inbound TCP 555 and 8555 and outbound UDP 5504-5507. These ports carry the second HDMI stream.
• If the multicast port base is not 5500 (see device settings), replace 5500-5503 with that base through base+3, and 5504-5507 with base+4 through base+7.

WolfVision recommends keeping devices up to date and using dedicated, managed network segments (VLAN or firewall zone) to restrict device access to trusted hosts only.