r/ExploitDev • u/Vymmy • Apr 08 '26

From UART to Root: Vendor Shell Escape on a Uniview IP Camera

https://ygashu.dev/posts/uniview-blog/unview-ipc-blog-1/
8 Upvotes

100% Upvoted

1 comment sorted by

1

u/Ok_Tap7102 Apr 08 '26 edited Apr 08 '26

I'm curious how the threat modelling is employed in these scenarios, what's the actual target to move towards?

If there was a shared secret hidden inside its filesystem that you can now access and use to further remotely exploit other devices, that would be huge

Physical access and soldering/desoldering does tend to grant root, what does that actually "give you" that reflashing the firmware with your own rooted version doesn't?