Responsible Disclosure: Ouvis C2 HD Security Camera

This disclosure documents insecure design and implementation in the Ouvis C2 HD IP camera: an exposed Telnet service with a hard-coded root password hash (shared across multiple OEM models) and an authenticated CGI-based remote code execution via unsanitized FTP configuration. The researcher achieved root access through UART, demonstrated command execution, reported the issues to the vendor with no response, and publicly released the findings after the disclosure deadline.