CVE-2016-8731: Hard-coded FTP credentials (r:r) are included in the Foscam C1 running firmware 1.9.1.12.

Security readout for executives and security teams

This issue affects Foscam C1 cameras running firmware 1.9.1.12. The firmware includes a built-in FTP credential pair, so exposed cameras may be remotely accessed if their FTP port is reachable from the internet. Treat exposed devices as urgent because the CVSS score is 9.8 and impacts confidentiality, integrity, and availability. Exposure is likely limited to Foscam C1 webcams running firmware 1.9.1.12, especially devices reachable from the internet on port 50021. The source bundle does not identify other models, firmware versions, or products as affected. Prioritize any internet-exposed affected cameras for immediate containment. The business concern is unauthorized remote camera access and potential device control, not just a software defect. If affected devices are isolated from untrusted networks, urgency is lower but remediation tracking remains warranted. Mitigation focus: Block external access to the camera FTP service, including port 50021.; Remove affected cameras from direct internet exposure.; Place devices behind VPN or isolated management networks..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.