Yellowbrik PEC-1864 authentication bypass

Vulnerability

The Yellobrik PEC-1864 implements authentication checks solely via JavaScript in the frontend interface, which can be bypassed when the device is accessible over the network. All versions of the PEC-1864 are affected. The device has been discontinued and no patch has been issued by the manufacturer [1].

Exploitation

An attacker with network access to the device can bypass the frontend authentication by intercepting or manipulating the JavaScript-based checks. No prior authentication is required; the attacker simply needs to access the web interface.

Impact

Successful exploitation allows the attacker to change the device password (leading to denial of service for legitimate users), change the streaming source (compromising stream integrity), or change the streaming destination (compromising stream confidentiality) [1].

Mitigation

No patch is available. The manufacturer recommends that the device should only be connected to secure/private networks and not exposed to public networks. As the product is discontinued, replacement with a supported alternative is advised [1].