IoT camera firmware: how did a 2002 flaw reach 2026 devices?

TL;DR: A budget home security camera shipping in 2026 was found with CVE-2002-1819, a network-reachable directory traversal in jdbhttpd that exposed files, credentials, and a cloud token, according to Finite State, showing how weak component inventory and reachability review let old flaws survive in consumer devices. Supply-chain governance fails when teams know a product exists but cannot prove what code it actually contains.

Editorial analysis by NHI Mgmt Group, based on content published by Finite State: “A 20-Year-Old IoT Vulnerability Is Still Shipping in a 2026 Home Camera”.

Key questions

Q: What breaks when an embedded device ships with an old network-reachable flaw?

A: The failure is usually not the age of the bug but the combination of reachability, privilege, and missing inventory.

Q: Why do old firmware flaws still matter in consumer IoT products?

A: Old flaws still matter when the vulnerable component is present in current builds and the attacker can reach it.

Q: How can security teams tell whether an SBOM is enough for IoT risk management?

A: An SBOM is necessary, but it is not enough if it lacks shipped-firmware accuracy and reachability context.

Practitioner guidance

• Audit shipped firmware against public vulnerability data Build a process that compares the exact firmware and binary components you ship against known advisories before release and after updates.
• Enforce least-privilege service permissions in embedded code Review every service in the device for file and process access it does not need.
• Track white-label provenance across the product chain Record the platform maker, relabeler, and retail brand for every device family you buy or ship.

Bottom line: The core failure was not an exotic exploit but a shipped embedded component that remained reachable, privileged, and ungoverned for years.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →