| 标题 | Apeman IP CAMERA Model ID71 sysversion: 218.53.203.117 Leak Credentials |
|---|
| 描述 | During local testing we observed that device secrets (including the web admin account admin and its password, as well as configured Wi-Fi SSID/password) are printed to the serial console (UART) in cleartext. The credentials are present both in /system/www/system.ini and /system/param/login.cgi, and identical credentials are visible on the UART during boot/runtime without authentication.
Impact: An attacker with physical access to the device (or to accessible UART pads) can obtain administrative and wireless credentials and gain administrative access to the device and/or join the local network. This enables device takeover, configuration changes, firmware replacement, data exfiltration, and network pivoting.
Vendor status:
The vendor APEMAN no longer sells this camera model. It appears to have been discontinued or rebranded. Attempts to contact the vendor were unsuccessful.
From my research, it seems that Apeman no longer sells or officially supports security cameras, including the Model ID71. Their current official website (https://apemans.com) focuses exclusively on projectors and dashcams, with no mention of their legacy IP camera line.
Because of this, there is no longer an active vendor website or support portal that references the ID71 camera. Historical product information is only available through third-party sources (e.g., archived sales pages, second-hand listings, and user forums). |
|---|
| 来源 | ⚠️ https://github.com/juliourena/APEMAN-Camera-PoCs/blob/main/UART-Leak-Credentials/leakcredentials.md |
|---|
| 用户 | juliourena (UID 90207) |
|---|
| 提交 | 2025-10-05 15時24分 (1 年前) |
|---|
| 管理 | 2025-10-16 16時23分 (11 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 326209 [Apeman ID71 218.53.203.117 /system/www/system.ini 弱身份验证] |
|---|
| 积分 | 0 |
|---|