Camera ships with no password, not 12345

[widgetii]

Current firmware gives root no password at all. Until one is set the camera streams nothing, and the setup page it serves is the only thing it will answer — so there is nothing to sign in with beforehand.

The post-flash instructions still said to sign in as root / 12345 and change it afterwards, which describes firmware nobody is flashing any more.

What it says now

Open camera's web interface on http://<address>/. A new camera has no password yet and streams nothing until it has one, so it asks you to choose a password before anything else. That password belongs to root and is the one the web interface, ssh, UART, RTSP and ONVIF all use.

Rewritten for en, ru and zh — the three locales this repository still carries. (The de/es/fa/fr/it/pl/pt files were dropped upstream; I'd initially written all ten before refetching and finding them gone.)

One thing worth knowing for future edits here

These info_html values are unquoted YAML scalars. A colon followed by a space anywhere inside one turns the rest of the line into a mapping and the file fails to load. My first Russian draft read <b>root</b>: его же используют… and broke ru.yml exactly that way; it now uses a comma instead.

Verified by parsing all 15 files in config/locales/ with yaml.safe_load and reading the three changed values back out of the parsed tree, rather than eyeballing the diff.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Correct default-password guidance across supported locales

🐞 Bug fix 📝 Documentation 🕐 Less than 10 minutes

AI Description

• Correct post-flash guidance to state new cameras initially have no root password.
• Explain password setup blocks streaming and supplies credentials across all camera interfaces.
• Synchronize corrected instructions across English, Russian, and Chinese locales.

Diagram

graph TD
  L["Localized guidance"] --> W["Camera web UI"] --> P{"Password set?"}
  P -->|No| S["Password setup"] --> R["Root credential"] --> A["Web SSH UART"]
  R --> M["RTSP ONVIF"]
  P -->|Yes| A

Loading

High-Level Assessment

Updating the existing localized success messages is the appropriate approach because the defect is inaccurate user guidance, not firmware behavior. The three supported locales remain aligned, and the wording avoids YAML-sensitive colon-space sequences in unquoted scalars.

Files changed (3) +3 / -3

Documentation (3) +3 / -3

en.ymlCorrect English first-run password guidance +1/-1

Correct English first-run password guidance

• Replaces obsolete root/12345 sign-in instructions with the current first-run behavior. The message explains that streaming remains disabled until a root password is chosen and that all camera interfaces share it.

config/locales/en.yml

ru.ymlCorrect Russian first-run password guidance +1/-1

Correct Russian first-run password guidance

• Rewrites the Russian post-flash message to describe passwordless initial state, mandatory password setup, and shared root authentication. The phrasing also remains safe as an unquoted YAML scalar.

config/locales/ru.yml

zh.ymlCorrect Chinese first-run password guidance +1/-1

Correct Chinese first-run password guidance

• Updates the Chinese success message to remove the obsolete default password and explain the stream-blocking setup flow. It identifies the new root password as shared by the web, SSH, UART, RTSP, and ONVIF interfaces.

config/locales/zh.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[widgetii]

Corrected in the latest commit: the sentence claimed the root password is what ONVIF checks, which is only half true.

ONVIF accepts it from clients sending HTTP Basic or WSSE PasswordText, but not from ones that authenticate with a digest — a digest is computed over the cleartext password, and the system database stores only a one-way hash, so there is nothing to compute it from. Those clients need onvif.password set separately. It is the common case rather than a corner: PasswordDigest is what most ONVIF clients try first.

Caught by review on OpenIPC/wiki#500, which carried the same sentence.