Ivan Nikolskiy

The Denver SHC-150 Smart Wifi Camera contains a hardcoded telnet credential issue that allows unauthenticated attackers to access a Linux shell. Attackers can connect to port 23 using the default credential to execute arbitrary commands on the camera's operating system. The affected device allows full shell access.

Denver SHO-110 IP cameras have a secondary HTTP service accessible on TCP port 8001. This service provides access to the `/snapshot` endpoint without requiring authentication. An attacker can retrieve image snapshots by directly requesting the `/snapshot` endpoint, potentially reconstructing the camera stream and compromising the confidentiality of the monitored environment. The primary web interface on port 80 enforces authentication, but the backdoor service bypasses this security measure.