Security flaw found in IP2M841

[mikedev]

Check yours! Mine is IP2M841 and this flaw may exist on other products too.

The security flaw is, even I setup an user with only single permission to view live, NOTHING more, no PTZ, etc. The user is still able to use PTZ function (with popular free app like tinyCam Monitor or AMCREST's API)!!! Wow!

Detail: I have setup an user named "view" and place it in a group "view_only" with "Live" permission only, nothing more. (please refer to screenshots in the attachments). Then, I logout and login on PC with the new user "view", yes, the web admin page does not show the PTZ control module. However, when I use a popular, famous and much user-friendly mobile app "tinyCam Monitor" on android, the PTZ function works!!!! It's free, amcrest should try and QA the product! Moreover, I tried the API that Amcrest provided, using the credential of the user "view", yes, the PTZ functions work too!!!
The security policy fails to enforce in the camera.
The scenario is, I used it as a baby monitor currently, in my bedroom, zoom and focus on the baby. I setup the "view" user for view only purposes for my family members, but for sure they don't need the privileges to zoom or pan/tilt the camera to view other area of my bedroom nor how my wife and I change clothes or pose of sleeping.

This issue can be very easily duplicate, I am very concern the firmware on the camera.

[mikedev]

Just got another email officialy from amcrest, but they did NOT mention about their willingness to fix this flaw... they even dare to say that the ticket will be closed without fixing this security flaw or how it will be handled.

Very disappointed.

The camera for sure will be returned to the retailer for a full refund by the end of the return period.

Unacceptable customer service.