{"uuid": "54688a7a-7470-443f-a678-ce96241c9e91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-57049", "type": "seen", "source": "https://t.me/hacking_Attack/190954", "content": "How one russian-speaking operator chained camera and router CVEs into a proxy and viewing pipeline against Ukraine\nhttps://www.reddit.com/r/redteamsec/comments/1vktd2p/how_one_russianspeaking_operator_chained_camera/\n\nAnalysis of two open directories showing the offensive workflow one operator used against exposed cameras and routers.  A custom project the operator named camview: fingerprints cameras over ONVIF, tests known CVEs, brute-forces HTTP/RTSP creds from a 3,811-pair list, and caches working creds and stream patterns to improve on later runs Proxy-through-victim: a script authenticated to a compromised OpenCart admin panel and relayed traffic through the victim network, with fallback logic for expired sessions Second directory chained TP-Link Archer CVE-2024-53375 and CVE-2024-57049 and brute-forced the MikroTik API, then flipped devices into SOCKS5 proxies reporting to a chisel listener on port 4444 Recon was Tor-routed via local SOCKS5 on 9050, including headless Chrome over Tor to fingerprint an anti-bot-protected target  Full writeup: https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-toolkit    submitted by    /u/Straight-Practice-99  (https://www.reddit.com/user/Straight-Practice-99) \n [link] (https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-toolkit)   [comments] (https://www.reddit.com/r/redteamsec/comments/1vktd2p/how_one_russianspeaking_operator_chained_camera/)", "creation_timestamp": "2026-09-01T20:00:05.717009Z"}