A popular Wansview indoor security camera was shipping in 2026 with a web server vulnerable to a flaw first disclosed more than two decades ago.
The finding comes from firmware security company Finite State, whose researchers analyzed the Wansview WVC Q5, an inexpensive Wi-Fi camera marketed as a baby monitor, pet camera, and indoor security camera. During the assessment, they found the device included jdbhttpd/0.1.0, a lightweight HTTP server affected by CVE-2002-1819, a directory traversal vulnerability originally disclosed in 2002.
The WVC Q5 is a white-label product built on an IoT platform developed by AjCloud, meaning the same firmware may be used by multiple camera brands. Finite State warns that while it confirmed a fix for the Wansview-branded device, other products based on the same platform should be considered potentially vulnerable until vendors verify otherwise.
The vulnerability allowed anyone on the same network as the camera to retrieve arbitrary files from the device without authentication using a specially crafted HTTP request. During testing, researchers extracted sensitive information including administrator credentials, system configuration files, cloud access tokens, and even the vulnerable web server binary itself. The report notes that the default administrator credentials remained admin:123456, further increasing the potential impact.
Analyzing the extracted binary led the researchers to uncover two additional unauthenticated vulnerabilities that could repeatedly crash the camera's web server or force the device to reboot. Although Finite State did not develop a full remote code execution exploit, it said the software lacked modern security mitigations such as ASLR, stack canaries, and non-executable memory protections, making further exploitation plausible for a determined attacker.
The researchers argue the incident exposes broader weaknesses in the IoT software supply chain. The vulnerable component remained in shipping firmware because none of the organizations involved, from the platform developer to the brand selling the camera, maintained an accurate inventory of third-party software or checked it against publicly known vulnerabilities. Since the vulnerable web server identifies itself with a distinctive “Server: jdbhttpd/0.1.0” banner, internet-facing devices could also be easily identified through large-scale scanning.
Finite State disclosed the issues to Wansview and AjCloud through a coordinated vulnerability disclosure process beginning in January 2026. Wansview ultimately addressed the problem by removing the vulnerable web server entirely instead of patching it and replacing its functionality with a different implementation. The fixed firmware (version 01.10715.11.37) was rolled out automatically to Wansview customers through an over-the-air update in April 2026.
For users of other cameras built on the same underlying platform, however, the patch status remains unclear. The researchers recommend keeping IoT devices updated, placing cameras on isolated network segments where possible, blocking unnecessary inbound access, and treating devices built on shared white-label platforms with extra caution until vendors confirm fixes.
Leave a Reply