A chain of six vulnerabilities in cameras using Fullhan’s FH8626V100 chip exposes command execution, administrator credentials and Wi-Fi passwords, enabling attackers to take complete control.
Fullhan-branded IP camera modules built around the FH8626V100 system-on-chip expose a set of flaws that, taken together, can lead to complete compromise of the device. Security research published by Amir Aliu and mirrored on Exploit-DB describes a chain of weaknesses affecting rebranded cameras sold under multiple names and running firmware v201222.1007 on the AJL30PG0803 device, with the affected platform also identified as part of the wider FH86xx family.
The most serious issue is an unauthenticated command-injection flaw on TCP port 1300. According to the research, the service accepts commands wrapped in <SYSTEM>...</SYSTEM> tags and passes them through without checking credentials, allowing arbitrary operating-system commands to run. The same write-up says the PSIA web API under /PSIA/* also permits unauthenticated access to device and network settings, creating a second route into the camera’s configuration and control plane.
Other exposures widen the attack surface further. The research notes that an unauthenticated JPEG snapshot is available on TCP port 6688, while BusyBox telnetd is enabled by default through inetd. In the documented chain, an attacker can use the command-injection flaw to reset the root password, then log in over Telnet and obtain a root shell. The author also reports that /PSIA/Security/AAA/users reveals the administrator username and password in clear text without authentication, and that once shell access is obtained, the Wi-Fi credentials are stored in plain text in /app/userdata/ifcfg.wlan0.
The vulnerabilities have been assigned CVE-2026-51402 through CVE-2026-51407, covering unauthenticated command execution, insecure API access, information disclosure and plaintext credential storage. Fullhan’s public website identifies the company as a designer and manufacturer of SoCs for IP camera applications, but the research indicates that the practical risk lies in how the chipset has been rebranded and deployed in downstream products. The proof-of-concept code published alongside the findings demonstrates how little interaction is needed to move from network access to full device control.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
