The remote IZON IP Camera is prone to a hard-coded credentials bypass vulnerabillity

Attackers can exploit these issues to gain unauthorized access to the affected device and perform certain administrative actions.

Ask the Vendor for an update.

A user can login to the Telnet service (also with root privileges) using the hard-coded credentials root:stemroot admin:/ADMIN/ mg3500:merlin

Start a telnet session with the hard-coded credentials.

• https://blog.duosecurity.com/2013/10/izon-ip-camera-hardcoded-passwords-and-unencrypted-data-abound/
• https://securityledger.com/2013/10/apple-store-favorite-izon-cameras-riddled-with-security-holes/

---

Updated on 2015-03-25