Brickcom IP-Camera Remote Credentials and Settings Disclosure
Brickom Cameras allow a low-privilege user to disclose every configuration in the NVRAM, including credentials in clear text, remotely by making a simple requests. This vulnerability, coupled with the fact that there are two default users with known passwords which are rarely modified, allows an attacker to disclose the admin password and latter every config. The most Critical API call is users.cgi?action=getUsers, which provides every user credential. Many other API calls to get information for the WIFI password or FTP credentials, even the whole configuration, are affected depending on the camera model. On the hardware side, the UART console of some models (example: WCB-040Af, with baudrate 38400) is exposed in the PCB and after soldering the corresponding pins and connecting, the resulting shell has root access. A simple NVSHOW command will list every config available in clear text, including credentials.
