# Backdoors in VStarcam cameras

DevFeed: [Backdoors in VStarcam cameras](<https://devfeed.tech/articles/backdoors-in-vstarcam-cameras-36630.md>)

Original publisher: [Read original article](<https://palant.info/2026/01/07/backdoors-in-vstarcam-cameras/>)

Author: Wladimir Palant

Published: 2026-01-07T13:01:48Z

Content type: article

Language: en

Sources: [Almost Secure](<https://devfeed.tech/sources/almost-secure.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [backdoor](<https://devfeed.tech/topics/backdoor.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [P2P](<https://devfeed.tech/topics/p2p.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>)

Tags: [backdoor](<https://devfeed.tech/tags/backdoor.md>), [cameras](<https://devfeed.tech/tags/cameras.md>), [p2p](<https://devfeed.tech/tags/p2p.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

An investigation of VStarcam cameras finds that firmware mechanisms systematically undermine administrator-password protection by leaking passwords and exposing cameras through internet-connected P2P functionality. The article also examines insecure firmware updates delivered over plain HTTP and recommends restricting internet access with a network firewall or using custom firmware.

## Source excerpt

VStarcam is an important brand of cameras based on the PPPP protocol. Unlike the LookCam cameras I looked into earlier, these are often being positioned as security cameras. And they in fact do a few things better like... well, like having a mostly working authentication mechanism. In order to access the camera one has to know its administrator password. So much for the theory. When I looked into the firmware of the cameras I discovered a surprising development: over the past years this protection has been systematically undermined. Various mechanisms have been added that leak the access password, and in several cases these cannot be explained as accidents. The overall tendency is clear: for some reason VStarcam really wants to have access to their customer's passwords. A reminder: "P2P" functionality based on the PPPP protocol means that these cameras will always communicate with and be accessible from the internet, even when located on a home network behind NAT. Short of installing a custom firmware this can only addressed by configuring the network firewall to deny internet access. Contents How to recognize affected cameras Downloading the firmware Caveats of this survey VStarcam's authentication approach Endpoint protection Unauthenticated log access Explicit password leaking via logs Log uploading Password-leaking backdoor Establishing a timeline The impact Coordinated disclosure attempt Recommendations How to recognize affected cameras Not every VStarcam camera has "VStarcam" printed on the side. I have seen reports of VStarcam cameras being sold under the brand names Besder, MVPower, AOMG, OUSKI, and there are probably more. Most cameras should be recognizable by the app used to manage them. Any camera managed by one of these apps should be a VStarcam camera: Eye4, EyeCloud, FEC Smart Home, HOTKam, O-KAM Pro, PnPCam, VeePai, VeeRecon, Veesky, VKAM, VsCam, VStarcam Ultra. Downloading the firmware VStarcam cameras have a mechanism to deliver firmware updates (Loo