Anpviz's first remediation image: wrong board, partial fixes, and open questions

Sat, 07 Nov 2026 12:00:00 +0000

Research status, 7 November 2026 UTC. This follows my initial IPC-D240W-S report. Anpviz sent me an assessment and a V3.6.3.1 firmware image on 6 November, describing the image as a remediation build for my V3.5.2.1 camera. I compared it statically with a read-only capture from my own camera and earlier Anpviz releases. I have not installed or run the new image. Both of my cameras run my own firmware, so I cannot claim that any new build has passed a live regression test on an IPC-D240W-S.

Security findings in an Anpviz IPC-D240W-S camera

Thu, 05 Nov 2026 12:00:00 +0000

Research status, 5 November 2026 UTC. I examined stock firmware for an Anpviz IPC-D240W-S after a password problem made my camera appear inaccessible. The tested unit ran V3.5.2.1 on SigmaStar Ifado hardware. I privately reported the findings to Anpviz beginning 17 October and submitted them to CISA/CERT/CC on 19 October (CISA case #116607; CERT/CC VRF #26-10-FZTVG). The disclosure date is under discussion; no coordinator-approved date or vendor fix is established in the records I have reviewed.

Firmware on matthewd.xyz

Anpviz's first remediation image: wrong board, partial fixes, and open questions

Security findings in an Anpviz IPC-D240W-S camera