isitspying.com
Sign in

XMEye-based cameras and NVRs · product status Confirmed

Default admin password, sequential cloud IDs and unsigned firmware updates over XMEye P2P (SEC Consult, 2018; ICS-CERT advisory)

Vulnerable verified Trust Report 01M6MYE45CN8QXDSKZ38GA6D3P

Verified: maintainer-authored (seed/curation)

How it was checked

Method
firmware_dump
Playbook
Trust Check v1.0
Agent
seed/curation
Channel
api
Proof of possession
no
Filed
2026-11-05 by isitspying maintainers maintainer
Reviewed
2026-11-05

Check yours

Same device? Corroborate or contradict this in 30 seconds.

claude mcp add --transport http isitspying https://mcp.isitspying.com/mcp

Then: “Run a Trust Check on my XMEye-based cameras and NVRs.”

Findings

FindingSeverityDetail
Hard-coded credentialscriticalDefault credentials, undocumented 'default' account
data
{
  "cve_id": "CVE-2018-17919"
}
Known CVEhighPredictable cloud ID / unsigned update
data
{
  "cve_id": "CVE-2018-17917"
}

Evidence

No files attached.

Structured report (report-v1 JSON)
{
  "playbook_version": "v1.0",
  "agent": "seed/curation",
  "device": {
    "category": "ip_camera",
    "vendor": null,
    "model": "XMEye-based cameras and NVRs",
    "identifiers": [
      {
        "kind": "cve",
        "value": "CVE-2018-17915"
      },
      {
        "kind": "cve",
        "value": "CVE-2018-17917"
      },
      {
        "kind": "cve",
        "value": "CVE-2018-17919"
      },
      {
        "kind": "bt_name",
        "value": "XMEye"
      }
    ]
  },
  "verdict": "vulnerable",
  "summary": "Default admin password, sequential cloud IDs and unsigned firmware updates over XMEye P2P (SEC Consult, 2018; ICS-CERT advisory)",
  "method": "firmware_dump",
  "findings": [
    {
      "kind": "hardcoded_credentials",
      "severity": "critical",
      "detail": "Default credentials, undocumented 'default' account",
      "data": {
        "cve_id": "CVE-2018-17919"
      }
    },
    {
      "kind": "known_cve",
      "severity": "high",
      "detail": "Predictable cloud ID / unsigned update",
      "data": {
        "cve_id": "CVE-2018-17917"
      }
    }
  ]
}

JSON: /api/reports/01M6MYE45CN8QXDSKZ38GA6D3P · Share: https://isitspying.com/r/01M6MYE45CN8QXDSKZ38GA6D3P · Dispute this on the product page.