I have recently reported a vulnerability in Yale IP camera WIPC-303W.
Yale is is one of the world's oldest lock manufacturers, owned by Assa Abloy (from Wikipedia) , and apparently they also started manufacturing cameras and other IoT products for home security a few years ago.
VULNERABILITY DETAILS
This vulnerability allows attackers who have managed to authenticate successfully with the web interface of the camera's management system, to send a specially crafted packet which will result in the attacker's ability to run arbitrary commands on the camera itself remotely.
This is possible due to a lack of input validation in one of APIs the web CGI exposes to the user, resulting in a command injection vulnerability.
Affected versions tested: WIPC-303W 2.21 - 2.31
