The cybersecurity firm Nozomi Networks has identified a high-severity vulnerability affecting the Open Network Video Interface Forum (ONVIF) implementation of certain IP security cameras produced by the Chinese firm Dahua Technology. The flaw, tracked as CVE-2022-30563, is a packet replay attack vulnerability which, if exploited, allows attackers to take full control of vulnerable internet-facing cameras. ONVIF is an open-source forum that promotes and develops standards dictating how IP-based cameras and other physical security IoT devices communicate in a “vendor-agnostic manner.” Specifically, the vulnerability exists in the authentication mechanism deployed in certain Dahua IP cameras known as “WS-UsernameToken”. Using a network packet analyzer to exploit this vulnerability, threat actors perform a man-in-the-middle (MITM) attack, capturing the HTTP packets associated with an authentication request n ONVIF. If the attackers successfully capture even a single unencrypted login packet, they can replay that exact packet along with a forged “CreateUsers” request to add themselves as administrators. They can then access any of the vulnerable devices with full privileges, allowing them to perform unauthorized activities like watching live camera feeds, locking or unlocking smart doors, and performing maintenance operations. These attacks could pose a threat to national security due to these IoT cameras being used in critical infrastructure to oversee production processes and provide remote visibility to engineers and security staff. Malicious state-sponsored threat actors and adversaries could exploit this vulnerability to conduct persistent video reconnaissance prior to an attack, giving them real-time intelligence of the target environment. This could allow threat actors to find new physical and technological vulnerabilities that could be exploited to conduct devastating cyberattacks against industrial control systems (ICS) and physically disrupt critical production processes. This vulnerability has been successfully patched, and CTIX analysts urge any administrators or security personnel utilizing Dahua IoT devices to ensure they are updating their devices to the latest secure version of the firmware. Aside from patching vulnerable IP cameras, organizations are strongly recommended to limit the presence of these public internet-facing IoT devices to the bare minimum, as well as using secure protocols like HTTPS.