Wansview IoT Camera Flaw Exposes Supply Chain Security Risks 

Security researchers at Finite State have disclosed multiple vulnerabilities affecting the Wansview WVC Q5 internet-connected camera, including a directory traversal flaw first documented more than 20 years ago. 

The findings show how outdated third-party software can expose modern IoT devices to credential theft, denial-of-service (DoS), and potential remote compromise. 

Larry Pesce, VP of Services at Finite State, said the discovery began as part of routine testing using a consumer device that was inexpensive, widely available, and commonly deployed as a baby monitor or home security camera. 

Key Takeaways of the Wansview IoT Camera Vulnerabilities

• Researchers found a decades-old directory traversal vulnerability in a modern Wansview IoT camera.
• Attackers could access credentials, cloud API tokens, and other sensitive files without authentication.
• Shared white-label firmware platforms can allow vulnerabilities to affect multiple IoT brands.
• SBOMs and continuous software inventory help identify outdated third-party components before they become security risks.
• Organizations should segment IoT devices, maintain software inventories, and prioritize vulnerabilities based on exploitability.

Legacy Web Server Vulnerability in IoT Camera 

Researchers identified an outdated web server, jdbhttpd/0.1.0, running with elevated privileges to serve images stored on the camera’s SD card. 

The software contained CVE-2002-1819, a directory traversal vulnerability that has been publicly documented for decades.

Legacy IoT Vulnerability Exposes Sensitive Device Data 

According to Pesce, the vulnerability requires only a single unauthenticated HTTP request containing directory traversal sequences to access files outside the web server’s intended directory.

Because the vulnerable service runs with privileged access, an attacker could retrieve sensitive files including password hashes, plaintext administrator credentials, cloud API tokens, system configuration files, and even the web server binary itself. 

Pesce described the vulnerability as a “skeleton key” because of the extensive system access it provides without requiring authentication.

The exposure extends beyond the camera itself. 

Researchers noted that attackers obtaining default or reused credentials could potentially access additional devices on the same network, while cloud API tokens could expose cloud-hosted video streams and device management services. 

Downloading the device binary also gives attackers the opportunity to analyze additional vulnerabilities offline and potentially develop remote code execution exploits.

Additional IoT Vulnerabilities Increase Security Risk 

Finite State also identified two buffer overflow vulnerabilities that can repeatedly crash the camera’s web server using a specially crafted unauthenticated HTTP POST request.

Although researchers did not demonstrate remote code execution, Pesce emphasized that the absence of a public exploit should not be viewed as evidence that exploitation is impossible. 

Instead, he said the research timeline simply did not allow enough time to complete exploit development, adding that a determined attacker could likely continue where the researchers stopped.

For a security camera, repeated crashes create their own security concern by preventing the device from recording during an attack, effectively creating a denial-of-service condition when surveillance may be needed most.

How White-Label IoT Platforms Increase Software Supply Chain Risk 

The research also underscores broader software supply chain concerns within the IoT market.

According to Pesce, the Wansview device is built on a shared white-label platform developed by AjCloud, with IOTECH (Shenzhen) also identified during the disclosure process. 

Because multiple vendors often resell the same underlying hardware and firmware under different brand names, vulnerabilities affecting one platform may extend across numerous products.

Pesce noted that researchers confirmed remediation only for the tested Wansview model, while the security status of other products built on the same platform remains unknown. 

Since the vulnerable web server advertises its version through a standard HTTP banner, internet-wide search tools can quickly identify exposed devices.

Why SBOMs and Software Inventory Improve IoT Security 

Pesce attributes the issue less to malicious development practices than to poor visibility into third-party software components.

He said organizations cannot effectively monitor or patch software they cannot identify, making software bills of materials (SBOMs) a foundational security requirement. 

However, he cautioned that SBOMs provide little value unless organizations continuously map components to known vulnerabilities and prioritize remediation based on exploitability and reachability. 

He recommends that manufacturers strengthen software supply chain security by treating SBOMs as build artifacts, rejecting unsupported third-party components during development, enabling modern binary protections, and enforcing least privilege. 

He also advises maintaining coordinated vulnerability disclosure programs and requiring security updates to reach every branded device built on shared platforms. 

Together, these practices can help reduce the risk of outdated and vulnerable software remaining in production devices. 

How to Protect IoT Devices from Software Supply Chain Risks 

For organizations deploying internet-connected cameras or other IoT devices, researchers recommend assuming limited visibility into the underlying firmware and designing networks accordingly.  

• Isolate IoT devices on dedicated network segments.
• Block unnecessary inbound access and avoid exposing cameras directly to the internet.
• Change default credentials and verify firmware updates are installed.
• Inventory connected devices and request SBOMs from vendors during procurement.
• Prioritize risk based on exploitability and component reachability rather than simply counting known vulnerabilities.

Pesce said the broader lesson extends well beyond a single camera model. 

Modern connected devices frequently consist of software assembled from numerous third-party components, many of which may be shared across multiple vendors. 

Without continuous software inventory, vulnerability monitoring, and supply chain visibility, decades-old vulnerabilities can continue finding their way into newly released products.