Panic in the Nursery: Research finds Baby Monitors make Easy Targets

Rapid7 researchers conducted the first systematic study of wireless baby monitors and found multiple serious, in some cases remotely exploitable, vulnerabilities across products from six vendors (Philips, iBaby, Summer Infant, Gyonii, Lens Peek-a-View and TRENDnet). Issues include hardcoded administrative credentials, predictable object IDs that allow camera enumeration and access to stored video, account-bypass mechanisms that permit attacker-created accounts without notification, and other weak internal controls; vendors were notified but had not issued fixes at time of publication.