Cinnado D1
Tested on our bench
- Platform
- AJCloud
The Cinnado D1 is an indoor Wi-Fi camera sold under the Cinnado brand and run from the Wansview Cloud app, published by Ajcloud Labs Inc. The app's store listing describes live video, two-way audio, motion alerts, playback of recorded video, pan-tilt-zoom control and day and night vision. The listing gives no cloud pricing, and Cinnado's own site exposed no usable specification sheet when we consulted it, so resolution, card size and Wi-Fi bands are not stated here: check the label and the manual of your unit. Platform and security. The camera belongs to the AJCloud platform. Elastic Security Labs examined fifteen camera products from Wansview, Galayou, Cinnado and Faleemi and reported an access-control flaw in AJCloud's infrastructure that let a researcher read data from, and take control of, a camera they did not own, together with weaknesses in the peer-to-peer protocol, the ability to overwrite a device identity file and a possible buffer overflow in the configuration function. The researchers state that all devices running AJCloud firmware and connecting to the platform are affected. They also report that their attempts to contact AJCloud and Wansview to disclose the issues were unsuccessful, and the article reports no fix. If you own one, the reasonable stance is to limit exposure of the cloud side. Local stream. No official Cinnado page we could read documents RTSP or ONVIF for the D1. A community-documented path, rtsp://IP:554/live/ch0, is listed for AJCloud/Wansview-family cameras; it is not confirmed by the manufacturer, and a firmware may disable it. Verify it on your own unit before building any recording setup around it. Noviscan, Secufor's own product, lists the D1 in its camera catalogue with this community path, flagged as uncertain, and advises using the local stream only. This site is edited by Secufor.