Brickcom Camera Vulnerabilities: Detecting Video Feed Leaks and Admin Takeovers

---
title: Potential Brickcom Camera Unauthorized Access via Default Creds
id: 2e8b9c12-4a5d-4b8e-9c1f-3a6b5c7d8e9f
status: experimental
description: Detects potential login attempts to Brickcom camera interfaces using default credentials (admin:admin) or accessing admin paths without proper session headers. 
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-03
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: proxy
  product: any
detection:
  selection:
    c-uri|contains:
      - '/admin/'
      - '/setup/'
      - '/config/'
    cs-method: 'POST'
  condition: selection
falsepositives:
  - Legitimate administrator configuration
level: high
---
title: Brickcom Camera RTSP Stream Access from External IP
id: 5f7d8e9a-1b2c-3d4e-5f6a-7b8c9d0e1f2a
status: experimental
description: Detects external access to RTSP streams (port 554) on known Brickcom camera segments, which may indicate unauthorized feed viewing.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-03
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.1125
logsource:
  category: firewall
  product: any
detection:
  selection:
    DestinationPort: 554
    Protocol: 'TCP'
  filter:
    SourceIP|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter
falsepositives:
  - Authorized remote viewing from known corporate IPs
level: medium

// Hunt for successful HTTP/HTTPS connections to Brickcom cameras from external sources
let BrickcomCameras = DeviceNetworkEvents
| where DeviceName contains "Brickcom" or RemoteIP has_any ("192.168.1.10", "192.168.1.11"); // Update with known camera IPs
CommonSecurityLog
| where DeviceVendor in ("Brickcom", "Cisco", "Fortinet") // Adjust based on your firewall/proxy vendor
| where DestinationPort in (80, 443, 554, 8080)
| where DeviceAction == "Allowed" or SentBytes > 1000
| summarize count(), min(Timestamp), max(Timestamp) by SourceIP, DestinationIP, DestinationPort, DeviceAction
| join kind=inner BrickcomCameras on DestinationIP
| project Timestamp, SourceIP, DestinationIP, DestinationPort, count_

-- Hunt for established connections to common camera ports
SELECT Fd, Family, Type, RemoteAddr, RemotePort, State, PID, Starttime
FROM listen_sock()
WHERE State = 'ESTABLISHED'
  AND RemotePort IN (80, 443, 554, 8000, 8080)
  AND RemoteAddr NOT IN ('127.0.0.1', '::1', '0.0.0.0')

<#
.SYNOPSIS
    Scanner for Brickcom Cameras (Firmware 3.2.3.5.6).
.DESCRIPTION
    Scans a subnet for Brickcom web interfaces and checks for vulnerable version strings.
#>

$Subnet = "192.168.1." # Adjust to your camera subnet prefix
$StartRange = 1
$EndRange = 254

Write-Host "[+] Initiating scan for Brickcom cameras on $Subnet`0/$EndRange..." -ForegroundColor Cyan

for ($i = $StartRange; $i -le $EndRange; $i++) {
    $IP = "$Subnet$i"
    try {
        # Try to fetch the server header or a generic page to identify device
        $Response = Invoke-WebRequest -Uri "http://$IP/" -Method HEAD -TimeoutSec 2 -ErrorAction Stop
        
        if ($Response.Headers.Server -like "*Brickcom*" -or $Response.Content -like "*Brickcom*") {
            Write-Host "[!] FOUND Brickcom Device: $IP" -ForegroundColor Red
            
            # Attempt to get firmware info from a common info page
            try {
                $InfoPage = Invoke-WebRequest -Uri "http://$IP/cgi-bin/system.cgi" -Method GET -TimeoutSec 2 -ErrorAction SilentlyContinue
                if ($InfoPage.Content -match "3.2.3.5.6") {
                    Write-Host "    [CRITICAL] Vulnerable Firmware 3.2.3.5.6 Detected!" -ForegroundColor Red
                }
            } catch {
                Write-Host "    [WARN] Could not confirm firmware version. Manual check required." -ForegroundColor Yellow
            }
        }
    } catch {
        # Host is down or not a web server
    }
}

Write-Host "[+] Scan complete." -ForegroundColor Green