logo

Port 554 – RTSP (Real-Time Streaming Protocol)

Service:

rtsp

Protocol:

TCP/UDP

Port:

554

Used for:

Port 554 is used by RTSP to control live video and audio streams, commonly in IP cameras, DVRs, and surveillance systems.

Why It’s Open

Port 554 is the default port used by RTSP (Real-Time Streaming Protocol), a protocol designed for controlling streaming media servers. RTSP allows clients to remotely control video streams — playing, pausing, or recording live feeds — without actually transporting the content itself (which is typically done over RTP/RTCP). It’s widely used in IP cameras, CCTV/DVR systems, NVRs, media servers, and surveillance equipment for live video streaming and remote monitoring.

This port is typically open on network-connected cameras, video recorders, smart doorbells, and various surveillance products. RTSP runs over both TCP and UDP, though TCP is more common for direct control and setup of streaming sessions.

Common Risks

  • Unauthenticated Video Streams
    Many RTSP implementations lack authentication or use default credentials, allowing anyone to view live camera feeds.
  • Information Disclosure
    RTSP banners and responses can reveal firmware versions, camera model info, and network paths.
  • Sensitive Surveillance Exposure
    Publicly exposed RTSP streams may leak sensitive visuals from private facilities, homes, or critical infrastructure.
  • Exploitable Vulnerabilities
    Many older RTSP services are vulnerable to buffer overflows, path traversal, and authentication bypasses.
  • Used in Botnets
    Insecure IP cameras with RTSP have been historically targeted and recruited into IoT botnets (e.g., Mirai variants).

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

Enumeration & Testing

Check if it’s open

Terminal window
nmap -sT -p 554
nmap -sU -p 554

Grab RTSP banner:

Terminal window
echo -ne "OPTIONS rtsp://:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n" | nc  554

Use RTSP inspection tools:

What to Look For

CheckpointWhat it means
Port 554 open externallyRTSP service is exposed to the internet (should not be)
No authentication requiredAnyone can access the video stream
Default credentials in useDevices may be trivially compromised
Version info in headersCan aid fingerprinting and targeted exploitation

Mitigation

  • Restrict Access to Port 554
    Only allow trusted internal IPs to access RTSP streams.
  • Enable Authentication
    Configure strong RTSP credentials and disable anonymous access.
  • Change Default Passwords
    Replace vendor defaults immediately on all IP cameras and DVRs.
  • Keep Firmware Up to Date
    Many RTSP vulnerabilities stem from outdated, unpatched firmware.
  • Segment Surveillance Devices
    Isolate cameras/NVRs on a separate VLAN from the corporate network.
  • Use Encrypted Alternatives (if supported)
    Some systems support RTSPS (RTSP over TLS) — prefer it when available.

Known CVEs and Exploits