Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at

Author Topic: Trying to gain access to a SIEPEM camera  (Read 5415 times)

  • No avatar
  • *
August 25, 2015, 12:10:01 pm
Hey, I'm trying to gain access to a HI3518 based camera, the camera is this one: made by SIEPEMS.

I tried to access the serial console, but when I was soldering cables to the UART pins I lifted the TX solder pad and I can't find follow the trace to any other place where it's accessible to solder a wire.

The firmware of the camera is in  I downloaded it and took a look at it with an HEX editor and found what look like two password hashes in the firmware:


I have been trying to crack those but I haven't had any luck yet.

The other thing that I tried was to change the hashes in the firmware for one that I know the password, but the camera refuses to upgrade with my modified firmware, I think it must have some sort of signature/error checking that I'm breaking with my changes, but I haven't found it yet.

Any suggestions on how I might go about gaining telnet access?

  • No avatar
  • *
August 25, 2015, 04:16:50 pm
OK, after a bit more effort I managed to crack the password. The password if anyone has a similar camera is: cat1029.

Both password are the same, they just have different salts.

  • No avatar
  • *
May 26, 2016, 10:17:26 pm
Hi, i have a SIEPEM camera, model S6213Y-WRA, it is very similar to ESCAM QF300. It had a bug with the audio and i installed a new firmware. Something went wrong and now it is bricked. I want to connect to serial port, but it is hard to know which connector it is in the PCB. Did u manage to gain access?