#Foscam default password password#

#Foscam default password password#

'An attacker who has analyzed the device and discovered the hard-coded credentials can, if they manage to obtain the config back-up file, use these credentials to decrypt the file and discover the admin password inside the file.' Beyond the hardcoded passwordsį-Secure also said it found undocumented Telnet functionality command injection vulnerabilities privilege escalation flaws poor access control, which could allow access even through firewalled ports and more. 'The encrypted Foscam device configuration file contains the admin password, but this file can be exported from the device, and it is protected by hard-coded credentials which cannot be changed by the user,' F-Secure wrote in its report. Worse, those aren't the only hardcoded passwords F-Secure found. And, this hardcoded password could even be used to bypass custom user credentials. The hardcoded passwords are even more insecure because they are 'blank,' meaning an attacker could log in to the device with the ID 'admin' and no password would be required. One of the most critical vulnerabilities in the devices was the use of non-random, default hardcoded passwords both for admin access to the web user interface and the user account for the built-in FTP server of the IoT cameras. F-Secure only investigated the two devices, but said 'it is likely that many of these vulnerabilities also exist in other models throughout the company's product line, and in other products Foscam manufactures,' under inexpensive white label branding.

A report by F-Secure detailed 18 flaws in the Opticam i5, made by Foscam, and found many of those same flaws in the Foscam C2.