ipcam-vulnerability-research - Security research and reproducible test modules fo

项目说明

IP Camera Security Research Modules

Security research and reproducible test modules for known in IP cameras and embedded sur devices. Intended for authorized testing, research, and defensi.

I put these together while auditing IP cameras and NVRs on my own network. Each module is a standalone Python script that checks for one specific , prints a clear result, and optionally dumps e to a file. No frameworks, no dependencies beyond requests and the standard library.

What's here

Remote Code Execution

foscam_c.py -- Foscam HD cameras have a hardcoded factory account (factory~:Ak47@99) that survi and firmware updates. Once you're in, the addAccount endpoint passes user input straight into a shell command. Two requests from zero to root. C + C.

nuuo_c.py -- NUUO N's upgrade_handle.php takes the uploaddir parameter and hands it to the shell with no filtering. Semicolons in the input give you command execution without any credentials. This is in the CISA KE. C.

nuuo_c.py -- Older NUUO NVRs have a PHP debug utility (__debugging_center_utils___.php) that passes its "log" parameter directly to system(). No auth, no sanitization. There's a public Metasploit module for it. C.

.py -- 's e.cgi has no authentication and passes user input into a system command. Over 400 camera models affected. Akamai re-reported acti in 2025. C.

dlink_c.py -- D-Link DCS cameras leak the admin password in plaintext at /config/getuser (no auth). Then you use those creds to hit ddns_enc.cgi, which has a command injection. Both CVEs are in the CISA KE. C + C.

Hardcoded Credentials / Backdoors

sony_c.py -- About 80 Sony IPELA ENGINE models shipped with backdoor accounts baked into the firmware (primana:primana, debug:popeyeConnection). Can't be changed or removed by the admin. C + C.

axis_weak_password.py -- Axis cameras default to root:pass on the VAPIX API. This module tries a short list of common passwords against /jpg/image.jpg with Digest auth. A surprising number of deployments ne the default.

Information Disclosure

eze.py -- EZ consumer cameras expose /ISAPI/System/de without authentication, leaking device name, serial, MAC, firmware , and model. Some builds also expose live JPEG frames at /ISAPI/Streaming/channels/101/picture.

reolink_anon_snapshot.py -- Some Reolink cameras accept admin with an empty password on the Snap API endpoint, letting you pull live JPEG frames without real authentication. N expose multiple channels.

dahua_on.py -- Dahua, Amcrest, and Lorex cameras respond to ON without the required WS-Security authentication, exposing manufacturer, model, firmware , serial, and hardware ID.

xiongmai_c.py -- Xiongmai XM530-based cameras (sold under dozens of OEM brands) respond to ON without authentication. Knowing the firmware is the first step toward chaining with more serious bugs. C.

geo.py -- Geo GeoWebServer has a path tra in //bin/WebStrings.srf that lets you read arbitrary files from the server (win.ini, /etc/passwd, etc.). C.

Detection Only (no exploit payload sent)

dlink_c.py -- The D-Link DCS-960L has a stack buffer o in its HNAP handler. This module only fingerprints the device and checks the firmware . No o payload is sent. C.

ez.py -- Checks if EZ endpoints associated with C (stack buffer o) are reachable without authentication. Detection only, no o sent. Also checks for unauthenticated encryption key disclosure. C.

Authentication Bypass

wyze_c.py -- Wyze Cam v2/v3/Pan v2 use ThroughTek's TUTK protocol. On unpaired or factory-reset devices, the auth key is all zeros, so a null-auth handshake passes. This module sends a 25-byte probe over raw TCP and checks the response code. No full session is established. C.

How to use

Each module is a standalone script. You need Python 3.6+ and requests:

Basic check:

With custom port and timeout:

Dump e to file:

Every module prints one of three results:

Remediation

The fix depends on the device, but for most of these:

1. Update firmware to the latest from the manufacturer
2. Change default passwords to something strong and unique
3. Put cameras on a separate VLAN with no internet access
4. Disable services you don't use (ONVIF, FTP, Telnet, SSH)
5. If the device is end of life with no patches a, replace it

For the D-Link DCS models (C, C): these are discontinued. There are no patches coming. Replace the hardware.

Disclaimer

These modules are for authorized security testing and research only. Use them on your own devices or on systems where you ha written permission to test. I wrote these to audit my own cameras and I'm sharing them so other people can check their own setups.

I am not responsible for how anyone else uses these scripts. Don't scan things you don't own.

License

Free to use however you want. No restrictions.

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Security research and reproducible test modules for known vulnerabilities in IP cameras and embedded surveillance devices. Intended for authorized testing, vulnerability research, and defensive validation.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。