MEDIUM
The severity is rated MEDIUM due to the potential loss of critical footage during a break-in event. This issue can be exploited in homelab and production environments if users rely on this software for security purposes without an offline fallback mechanism. Patches are unlikely as it requires architectural changes, meaning the window of exposure remains open until Scrypted implements offline licensing or robust error handling.

Scrypted NVR is a paid software solution designed for continuous video recording with advanced features like object detection. Recently, a significant issue was identified where the software's online license checking mechanism failed due to silent DNS errors. This failure caused the server to stop recording footage entirely, which can have severe consequences during critical events such as break-ins. The problem stems from Scrypted’s design decision to rely on an active internet connection for license validation, which is not a standard practice in mission-critical software where offline licensing should be implemented. Engineers and sysadmins need to carefully evaluate the reliance on external services for core functionalities like recording, especially when dealing with security-sensitive applications.

Affected Systems
  • Scrypted NVR
Affected Versions: All versions
Remediation
  • Disable online license checking by modifying the configuration file at /etc/scrypted/config.json and set "onlineLicenseCheck": false.
  • Implement a local DNS resolution or use a more reliable DNS service to mitigate silent failure issues.
  • Consider using alternative software that supports offline licensing for critical applications.
Stack Impact

This issue has a significant impact on homelab stacks where Scrypted NVR is used as the primary security monitoring tool. Users relying solely on this solution may lose important footage during critical events if they experience network disruptions or DNS issues.

Source →