Overview:

Rapid7, a company that specializes in IT security, released a vulnerability report on video baby monitors, which included TRENDnet’s WiFi Baby Cam, model TV-IP743SIC. The report claims that the WiFi Baby Cam has a fixed user name and password that could be accessed via a direct UART serial connection to the WiFi Baby Cam. When Rapid7 notified TRENDnet about their report, our security team took immediate action to validate the claim. While physical access would be required to exploit the vulnerability, TRENDnet has found a solution and users will receive a notification to update their firmware.

How it’s executed?

Physical access to the WiFi Baby Cam is required to exploit this vulnerability. To add a direct UART serial connection, the housing must be opened to modify the circuit board. A computer will then need to be connected to the serial connection to finally run a terminal communication program.

Update Date: 02/25/2016

Affected TRENDnet products: