Ever wondered what happens if you throw away an old IP camera without a factory reset?
Lets se how bad it can be.
Trying the Default Login – Did It Work?
The first step in our experiment was to access the IP camera’s web portal using the default login credentials. Many cameras ship with factory-set usernames and passwords like “admin/admin“, "admin/password" or "admin/ " which users often forget to change.
However, in this case, our attempt failed—indicating that the previous owner had set a custom login and password. While this is a good security practice, it doesn’t mean the camera is completely safe from exploitation. There could still be stored Wi-Fi credentials, old footage, or other sensitive data left inside the device.
This raises an important question: How much information can we still recover, even without direct access to the web portal? Let’s dig deeper and find out!
Scanning for Open Ports – A Hidden Backdoor?
After failing to log in through the web portal, we ran a quick Nmap scan to check for open ports. The results revealed three active ports:
- Port 80 – Hosting the camera’s web interface
- Port 23 – Telnet access, which could be a major security risk
- Port 8600 – An unusual port, possibly used for device communication or a hidden service
The presence of Telnet (port 23) is particularly alarming. Many older devices leave Telnet enabled by default, often with hardcoded credentials that hackers can easily exploit. If we can gain access through Telnet, we might be able to bypass the web login altogether and retrieve sensitive data directly from the camera’s system.
Telnet Access – A Major Security Flaw
After discovering Telnet (port 23) open, we decided to run an Nmap script scan using:
nmap --script=telnet* -p23 -T4 <IP_ADDRESS>
Shockingly, the scan revealed valid login credentials for Telnet access. This means the camera was still using default or easily retrievable credentials, allowing anyone with basic tools to log in and take full control of the device.
Why This Is a Serious Problem
- Unauthorized access: With Telnet access, an attacker can directly interact with the camera’s operating system.
- Network infiltration: If Wi-Fi credentials are stored in plaintext, a hacker could gain access to the entire network.
- Full device control: Attackers can modify settings, view footage, or even use the camera as a bot for cyberattacks.
Telnet Access Granted – A Shocking Discovery
Using the credentials root:123456, we successfully logged into the Telnet session—giving us full access to the camera’s file system. This is already a massive security issue, but what we found next made it even worse.
Hunting in the File System
Once inside, we started exploring system directories, looking for sensitive files. Navigating through /etc/Wireless/RT2860/, we found a configuration file named RT2860.dat.
Curious, we opened the file and were shocked to find that it contained:
- The Wi-Fi SSID (network name)
- The Wi-Fi password—stored in clear text! 😨
Why This Is a Huge Security Risk
This means that anyone who finds or accesses an old, discarded IP camera could retrieve Wi-Fi credentials and gain access to the home or business network. Worse, many people reuse passwords across multiple devices, making it even easier for attackers to pivot into more sensitive accounts.
Final Discovery – Web Portal Credentials in Plain Text
Continuing our deep dive into the camera’s file system, we explored the /system/www/ and /param/ directory, which houses web interface / config files. Hidden within this folder, we found a system.ini and Login.cgi file. Curious, we opened them—and what we saw was shocking.
Inside system.ini and Login.cgi, the files contained:
🔴 The username and password for the web portal – stored in clear text!
This means that even though our initial attempt to log in through the web portal failed, we were still able to retrieve the login credentials by simply accessing the file system via Telnet.
What This Means for Security
- Any attacker who gains access to the camera’s Telnet session can completely take over the device, log in via the web interface, and modify settings.
- If the camera is connected to the internet, it could be accessed remotely using the leaked credentials.
- Many users reuse passwords, meaning this could also compromise other accounts.
The Takeaway – How to Stay Secure
If you own an IP camera or any smart device, follow these steps to protect yourself:
✅ Always perform a factory reset before disposal.
✅ Change default credentials immediately after setup.
✅ Disable Telnet and other unnecessary services.
✅ Regularly update firmware to patch security flaws.
This experiment highlights just how vulnerable old, discarded IoT devices can be. A hacker doesn’t need physical access to your home—just an abandoned device with weak security.