Is port 554 (RTSP) exposed to the internet, and how do I lock it down?

Why port 554 is open on so many cameras

RTSP (RFC 7826) is a control protocol, not an encryption standard — it negotiates and manages a media stream between a client (a viewing app or NVR) and a camera, and by default that negotiation and the resulting video stream are both unauthenticated and unencrypted. Camera manufacturers ship RTSP enabled out of the box because it’s the simplest way to let any third-party viewing app or recorder pull the feed, and many deployments never add the vendor’s optional authentication layer on top.

What’s actually at risk

At minimum, an exposed RTSP stream means unauthorized viewing of whatever the camera sees — a real privacy problem for a home, office, or retail camera. In 2014, the website Insecam drew wide media coverage (WeLiveSecurity, CBS News, TechCrunch) by indexing roughly 73,000 cameras worldwide that were reachable with unchanged default passwords, most delivering their feed over RTSP or a similarly unauthenticated stream — a stark public demonstration of how common this exposure pattern is. Some RTSP server implementations have also had separate authentication-bypass or buffer-overflow vulnerabilities over the years, meaning an exposed stream can occasionally be a foothold into the device itself, not just a video feed.

How to check your own exposure

Confirm your public IP with what is my IP, then AdminKit’s planned open ports check is designed to test whether port 554, alongside other commonly-exposed device ports, responds from outside your own network — only ever against the IP making the request, with consent.

How to fix it

• Change the camera’s default admin credentials — this is the single step that stops both casual scanning and tools like Insecam from working.
• Turn on the camera’s built-in RTSP authentication if it offers one; many budget cameras ship it disabled by default even though the firmware supports it.
• Remove any port-forward or UPnP rule exposing 554 directly to the internet; if you need to view the feed remotely, use the vendor’s cloud app or a VPN into your own network instead of forwarding the raw stream port.
• Re-run open ports check to confirm 554 is no longer reachable from outside.

See Telnet and RTSP camera/router exposure for the full walkthrough, including the closely related Telnet (port 23) exposure that shows up on the same hardware. Reference: RTSP.

Defensive use only

Every check this page links to is for assets you own or are explicitly authorized to test. Never scan, probe, or attempt to connect to a network or device you don’t control — AdminKit’s active checks only ever run against the IP making the request or an asset you’ve verified ownership of. See our Disclaimer and Acceptable Use Policy for the full terms.