Old flaw leaves Wansview camera exposing credentials

Finite State researchers identified three critical vulnerabilities in the Wansview WVC Q5 indoor Wi-Fi camera. One of the flaws was first disclosed in 2002.

The low-cost camera, marketed for baby monitoring, pet monitoring and home security, exposed administrator credentials, cloud API tokens and configuration data through a directory traversal weakness in an embedded web server.

Researchers also found two unauthenticated denial-of-service flaws. They said outdated software protections in the camera meant those issues could potentially be developed into a full device compromise, although they did not take that step during their work.

The findings point to a broader problem in consumer connected devices: software components can remain in products for years without being checked against known vulnerabilities. In this case, the vulnerable component was identified as jdbhttpd/0.1.0, a small web server that could be queried over the network without authentication.

According to Finite State, an attacker on the same network could use the directory traversal flaw to retrieve sensitive files from the camera with a single HTTP request. The exposed data included the system password, the administrator login and a cloud access token linked to the manufacturer's servers, where video feeds and device settings were stored.

Supply chain issue

The research also raised questions about how white-label hardware and software are assessed before products reach consumers. Finite State said the WVC Q5 is based on AjCloud firmware, a common platform used by multiple consumer camera brands, meaning the same underlying weakness may exist in devices sold under other labels.

A second manufacturer, IOTECH (Shenzhen) Company Limited, emerged during the disclosure process. Finite State said only the Wansview unit it tested had been confirmed as fixed, leaving uncertainty about the status of other products built on the same base.

That white-label structure is common in lower-cost electronics, where a platform maker develops the underlying hardware and software and multiple brands sell similar devices under different names and packaging. Security researchers and regulators have increasingly focused on that model because defects in one shared component can spread widely across the market.

Finite State said the age of the flaw was not the main issue. The more serious concern was that the vulnerable web server was reachable over the network and ran with permission to read files across the system, increasing the impact of an old, well-documented bug.

Researchers said they chose the camera because it was an ordinary consumer product that could be bought easily. Their analysis found the flaw was not hidden and could have been identified through a basic review of publicly known vulnerability data.

Vendor response

After being notified, Wansview removed the web server entirely and redesigned the video feature, according to Finite State. The fix was delivered automatically over the internet to online devices, a response the researchers described as more thorough than a limited patch to the original component.

The report said the update addressed the tested product, but not the broader issue of shared software components passing through multiple suppliers and brands without a clear record of what is inside the final product. That problem has become more prominent as governments push manufacturers to keep better software inventories for connected devices.

In Europe, the Cyber Resilience Act has increased pressure on device makers to maintain accurate records of software components throughout a product's service life. Security specialists often refer to these records as software bills of materials, or SBOMs, which are intended to show what third-party and open-source elements a device includes.

Finite State argued that an inventory alone is not enough if companies do not also assess whether a vulnerable component is exposed in a way an attacker can reach. In the Wansview case, the component was both exposed and running with broad privileges, making a known flaw more dangerous than many theoretical weaknesses that never become exploitable in practice.

The findings also underline the risks of placing low-cost smart devices on the same home or office network as laptops, phones or specialist equipment. A compromised camera can give an attacker a foothold inside a wider network, particularly where segmentation is weak or absent.

For consumers, the report highlights a recurring challenge in internet-connected products: the brand on the box may not reveal who built the software inside. For businesses tracking software supply chains, it offers another example of how an old bug can survive in current products when responsibility for checking components is diffuse.

"The broader software supply chain problem facing connected devices is that vulnerable components can persist for decades when software inventories, SBOM programs and continuous vulnerability monitoring are absent or incomplete," said Larry Pesce, Vice President of Technical Research and Offensive Security at Finite State.