IP Camera Research - Fullhan FH8626V100 (AJL30PG0803)

Security research on a consumer IP camera built on the Fullhan FH8626V100 SoC (model AJL30PG0803), resulting in six assigned CVEs covering unauthenticated API access, plaintext credential disclosure, and full unauthenticated device compromise via OS command injection.

Full writeup: Breaking Into My Own IP Camera

Device Overview

This firmware/SoC combination is reused across many differently branded consumer IP cameras, so the affected surface is broader than a single product listing.

CVE Summary

Exploitation Chain

1. Query /PSIA/Security/AAA/users unauthenticated to retrieve plaintext admin credentials (CVE-2026-51406), or skip straight to step 2.
2. Send a crafted <SYSTEM>...</SYSTEM> payload to TCP/1300 to execute a command that resets the root account password (CVE-2026-51402).
3. Authenticate to the always-on BusyBox telnetd (port 23) with the new root credentials to obtain a full interactive root shell (CVE-2026-51405).
4. From the shell, harvest /app/userdata/ifcfg.wlan0 for Wi-Fi credentials and/or pivot further into the local network (CVE-2026-51407). Each step individually requires no authentication except the final Telnet login, which is trivially satisfied by the attacker's own password reset in step 2, meaning the full chain from network access to root shell requires no valid credentials at any point.

Repository Structure

.
├── README.md
├── advisory/
│   └── fullhan-ipcam-advisory.txt   # Exploit-DB style advisory + PoC
├── poc/
│   ├── command_payloads.txt         # Fun abuse commands (play audio, reboot camera)
│   ├── data_extraction.py           # Unauthenticated read PoC (users, device info, snapshot)
│   └── full_chain.py                # RCE -> root password reset -> telnet shell chain
├── metasploit/
│   ├── command_payloads.txt         # Fun abuse commands (play audio, reboot camera)
│   ├── data_extraction.py           # Unauthenticated read PoC (users, device info, snapshot)
│   └── full_chain.py                # RCE -> root password reset -> telnet shell chain

Impact

An attacker on the local network or adjacent segment (or with internet exposure, if the device is port-forwarded) can obtain full root access to the device, view the live camera feed, exfiltrate the victim's Wi-Fi credentials, and use the compromised device as a pivot point into the victim's internal network — all without needing any valid credentials.

Disclosure Timeline

Responsible Use

This research was conducted against a device owned by the author. The code in this repository is provided for defensive research, detection engineering, and authorized testing only. Do not use it against devices you do not own or lack explicit authorization to test.

Credits

Discovered and reported by Amir Aliu

License

Free to use for personal research, education, and authorized security testing. Commercial use, resale, or redistribution as part of a paid product/service is not permitted without written permission.