A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a vulnerable URL.