In fact, all the 3rd party programs I have tried detected the camera as an ONVIF compliant device.

However I fail to see any improvement in Down/Up and Right/Left panning controls inverted and the Onvif compatility. :~$ telnet 192.168.1.ONVIF works, except with Synology (and I think its their fault) :~$ wget -user admin -password labpass1 &> /dev/null Telnet: Unable to connect to remote host: Connection refused However, if an authenticated user visits /web/cgi-bin/hi3510/printscreenrequest.cgi then telnetd starts up. Telnet is not enabled by default on the device. You can see the username (admin) and password (cheesedoodle) in the final plugin. It was possible to obtain a screenshot from the following URL The ONVIF server on port 8080 supports these services: The ONVIF service listening on UDP port 3702 advertisesĪudit-trail:success: The service listening on port 3702 has already been identified. LobsterTrap:plugin_dev albinolobster$ /Library/Nessus/run/bin/nasl -aWMXr -t 192.168.1.178. Here is an example from Nessus' ONVIF implementation: When the HW0021 replies to a remote unauthenticated user's GetSnapshotUri request it responds with a URL that includes the admin username and password.

This method returns a URL that links to the most recent camera snapshot. The ONVIF protocol supports a method called GetSnapshotUri. Its unclear to Tenable how Foscam and Wanscam are related.ĬVE-2017-11510: Administrator Username and Password Disclosure These vulnerabilities sound similar to a couple of vulnerabilities FSecure encountered in Foscam devices. While investigating Pierre Kim's disclosure, Multiple vulnerabilities found in Wireless IP Camera (P2P) WIFICAM cameras and vulnerabilities in custom http server, Tenable came across a couple of vulnerabilities in Wanscam's HW0021 network camera.

Wanscam center monitor fails