Anpviz camera security evidence, 2026

This is the companion to my initial security report and remediation review. The complete evidence repository contains the C-like Ghidra exports, 146 labeled source captures, 68 versioned finding dossiers, manifests and supporting excerpts. The evidence documents and source exports below open in GitHub’s file view; the screenshots remain on this site. This page is served at both matthewd.xyz and matthewd.org.

Scope and disclosure

The old V3.5.2.1 image came from a read-only capture of my own IPC-D240W-S (MCA40E). Anpviz’s supplied V3.6.3.1 image is for MCA50E; Anpviz acknowledged that error and told me not to flash it. I did not run the new image. Its findings are static and need confirmation on a correct MCA40E build. I reported the work privately beginning 17 October 2026 and coordinated with CERT/CC (VRF #26-10-FZTVG) and CISA (case #116607). The repository README gives the full CVD timeline and evidence limits.

The F and N labels are research IDs, not assigned CVE identifiers. CWE mappings are proposed. Eight conditional scenarios have provisional CVSS v4.0 scores; unscored rows lack a defensible numeric assessment or are inapplicable. Anpviz’s model-scope review and response are ongoing. No vendor firmware binary, calculated credential, device identifier, or operational exploit packet is hosted here.

Earlier public disclosures

These reports show that related camera products and firmware families had published authentication, credential, debug-access and update concerns before this investigation. They concern different models or firmware branches; their CVEs are not automatically applicable to my IPC-D240W-S or Anpviz’s supplied MCA50E image. The comparison and source notes explain the limits.

• Bishop Fox’s 2018 SV3C L-Series advisory (current advisory; NVD CVE-2018-12666) documented ten issues and said no fix had been released at publication.
• Willgues’s 2024 Anpviz report documented CVE-2024-35341 through CVE-2024-35344 and an account of repeated requests for a patch timeline without a substantive vendor response.
• andylee77’s 2026 Anjvision disclosure repository lists ten proposed issues in a different firmware family, including debug access and unsigned updates, and records contact with Anjvision and CERT/CC. Its README marks CVE IDs pending.

I published a separate account of my disclosure decision and the wrong-board firmware Anpviz sent for verification.

Finding dossiers

Each page explains the old or new code, assessment limits, proposed CWE and CVSS status, and links its relevant source captures. The raw C exports are linked from the dossier pages.

Browse the raw evidence

• Evidence index
• CVE candidate and CVSS v4.0 README
• Screenshot manifest
• Export hash manifest
• Repository on GitHub

Supporting files

• CheckA-direct-board-calls.tsv
• CheckA-libtools-direct-callers-new.tsv
• CheckA-libtools-direct-callers-old.tsv
• F10-index.js-admin-reset-new.txt
• F16-web_main_onvif_auth_global-new.disasm.txt
• F20-serial_extract-callers-new.txt
• F23-SetVersion-new.disasm.txt
• F7-F8-F10-userManageConfig.js.diff
• S0-config.default-mca40e-old_vs_mca50e-new.diff
• endpoints-urls-new.tsv
• endpoints-urls-old.tsv
• hardening-old-vs-new.txt
• inventory-diff.txt
• web/userManageConfig-new.js
• web/userManageConfig-old.js