cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote malicious users to obtain the administrator password via a list action.
===========================================================================
AIRLIVE
====================================================================
===========================================================================
1Advisory Information
Title: Airlive Multiple Vulnerabilities
Date Published: 12/06/2013
Date of last updated: 12/06/20 ...
Airlive IP cameras suffers from information disclosure, clear text storage of sensitive information, cross site request forgery, denial of service, and path traversal vulnerabilities ...
Vulmon