Responsible Disclosure: Amcrest View Web Portal

This research report details discovery and responsible disclosure of two security issues in the Amcrest IPM-721S camera ecosystem: an authorization bypass in the Amcrest View web portal that allows modifying another user’s account email (enabling takeover via password reset) and a stored XSS due to insufficient input sanitization; the author reported the issues to Amcrest and they were patched within 30 days.