Status: Work in progress - login credentials not yet cracked
Device: Litter-Robot 5 Pro (serial format:LR5-XX-XX-XX-XXXX-XXXXXX)
Camera OEM: iENSO Inc. (Toronto, ON, Canada) - ienso.com
Goal: Local RTSP access to the integrated camera without Whisker+ cloud subscription
The Litter-Robot 5 Pro ships with dual integrated 1080p HD cameras (front-facing and inner-facing) manufactured by iENSO, a Canadian embedded vision OEM. Camera features like live streaming, recording history, and cat facial recognition are paywalled behind Whisker's Whisker+ subscription. The free tier limits you to 5 minutes of daily live streaming and 2 days of cloud-stored event recordings.
The camera module runs its own embedded Linux system with a full-featured web interface on the local network - completely independent of Whisker's cloud. This document describes what's been found so far.
A full 65,535-port TCP scan reveals three open ports:
| Port | Protocol | Service | Notes |
|---|---|---|---|
| 80 | HTTP | lighttpd/1.4.66 | Serves the same React SPA as port 443 |
| 443 | HTTPS | lighttpd/1.4.66 | Primary web interface (React SPA) |
| 8888 | HTTP | lighttpd (assumed) | Secondary login page (Bootstrap-based) |
No other TCP ports are open - notably no RTSP (554), no telnet (23), no SSH (22). RTSP appears to require explicit activation through the web UI after authentication.
| Field | Value |
|---|---|
| MAC | 04:A1:6F:10:9D:8E |
| OUI Block | 04:A1:6F:10:00:00/28 |
| Registered To | iENSO Inc. |
This is a /28 block (only 16 addresses), indicating a small-batch OEM allocation specific to iENSO's embedded camera modules.
Issuer: C=CA, ST=ON, O=iENSO, CN=evpass
Subject: C=CA, ST=ON, O=iENSO, CN=evpass
Validity: 2020-12-31 to 2030-12-29
Key: RSA 4096-bit
Self-signed, Version 1 (v1)
The CN evpass likely refers to iENSO's EVPaaS (Embedded Vision Platform as a Service) product line.
A minified React single-page application (main.0e1380ba.js, ~2MB). The HTML shell references a CCTV camera favicon:
<link rel="icon" href="/cctv-camera-icon.svg" type="image/svg+xml">All CSS class names use the ienso- prefix (e.g., ienso-button, ienso-input, ienso-video__video-controls__play-button), confirming this is stock iENSO firmware.
Authentication is via POST to /system/login with JSON body:
{"username": "...", "password": "..."}All API endpoints return {"error":"unauthorized","success":false} without valid credentials. Invalid credentials return {"error":"invalid credentials","success":false} - no username enumeration (same error regardless of username).
A simpler login page titled "Device Login - iENSO" using Bootstrap CSS and jQuery. Uses the same /system/login endpoint with the same JSON format. Likely a legacy or maintenance interface.
All endpoints require authentication. Extracted from the minified React bundle on port 443:
| Method | Endpoint | Description |
|---|---|---|
| POST | /system/login |
Login (JSON: username, password) |
| POST | /system/logout |
Logout |
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/stream/settings |
Stream configuration |
| GET | /api/stream/settings/options |
Available stream options |
| GET | /api/stream/is_rtsp_up |
Check if RTSP is enabled |
| POST | /api/stream/start_rtsp |
Enable RTSP streaming |
| POST | /api/stream/start_webrtc |
Start WebRTC stream |
| POST | /api/stream/start_webrtc_signaling |
WebRTC signaling |
| GET | /stream/demo/channel/0/webrtc |
WebRTC stream path |
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/snapshot/perform |
Take a snapshot |
| GET | /api/snapshot/list |
List saved snapshots |
| GET | /api/snapshot/settings |
Snapshot configuration |
| GET | /api/snapshot/settings/options |
Snapshot options |
| POST | /api/recording/start |
Start recording |
| POST | /api/recording/stop |
Stop recording |
| GET | /api/recording/state |
Recording status |
| GET | /api/recording/list |
List recordings |
| GET | /api/recording/diskinfo |
Local storage info |
| POST | /api/recording/remove_all |
Delete all recordings |
| POST | /api/recording/remove_selected |
Delete selected recordings |
| GET | /api/recording/download_zip |
Download recordings |
| GET | /media/download |
Download media files |
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/camera/settings |
Camera configuration |
| GET | /api/image/settings |
Image settings (brightness, contrast, etc.) |
| GET | /api/image/settings/options |
Available image options |
| POST | /api/image/zoom |
Digital zoom control |
| GET | /api/day_night_mode |
Day/night mode status |
| GET | /api/day_night_mode/options |
Day/night options |
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/network/ip |
IP configuration |
| GET | /api/network/properties |
Network properties |
| GET | /api/network/settings |
Network settings |
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/system/info |
System information |
| GET | /api/system/logs |
System logs |
| POST | /api/system/reboot |
Reboot camera |
| POST | /api/system/reset |
Factory reset |
| POST | /api/system/format/memory |
Format local storage |
| GET | /api/device/settings |
Device configuration |
| GET | /api/device/settings/schema |
Device settings schema |
| GET | /api/device/time |
Date/time settings |
| GET | /api/server/settings |
Server configuration |
| POST | /api/settings/reset |
Reset all settings |
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/user/change_password |
Change admin password |
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/data-processing/settings |
AI/analytics configuration |
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/firmware/update |
Upload firmware |
| Method | Endpoint | Description |
|---|---|---|
| POST | api/app-runner/deploy |
Deploy SDK application |
The web interface includes controls for:
- Live View - WebRTC-based live streaming with play/pause, snapshot, and fullscreen
- RTSP Streaming - Toggle to enable RTSP with a URL displayed in the UI (note: "When RTSP is enabled, Live View stream is paused")
- Recording - Start/stop recording, file browser, preview, download (ZIP), delete
- Snapshots - Capture and manage snapshots
- Image Settings - White balance, brightness, saturation, sharpness, contrast, hue, noise reduction, dewarp, HDR, auto exposure, AE metering mode, gain, exposure time
- Day/Night Mode - Automatic IR switching
- Mirror / Flip - Image orientation (with warning: "if AI is enabled at the same time, data labels will appear reversed")
- AI Detectors - Motion detection with configurable zones/sensitivity, object detection (people, vehicles)
- Network Settings - IPv4 (DHCP/static), DNS, gateway, subnet, hostname, MTU, HTTP/HTTPS ports
- User Management - Change administrator login (username + password)
- Firmware - Version info, firmware update upload, restart, restore, factory reset
- Storage - Local storage status, capacity, format
- Logs - Downloadable system logs
These are client-side validation rules on the change-password form. The factory default password may or may not conform to these:
- Minimum 10 characters
- At least 1 lowercase letter
- At least 1 uppercase letter
- At least 1 number
- Cannot match the username
The following username/password combinations have been tried and all return {"error":"invalid credentials","success":false}:
Usernames tried: admin, root, evpass
Passwords tried: admin, Admin1234567, Password1234, Evpass123456, evpass, iENSO, ienso, password, whisker, plus various MAC-derived and serial-derived combinations.
- Unauthenticated API access - All endpoints return
{"error":"unauthorized","success":false} - WebRTC demo path -
/stream/demo/channel/0/webrtcreturns the SPA shell (React router catch-all), no unauthenticated stream - RTSP probing - Port 554 is closed;
ffprobeto various RTSP URLs returns connection refused - Full port scan - Only 80, 443, 8888 open across all 65,535 TCP ports
- Platform: Ambarella CV-series SoC (iENSO's EVPaaS uses Ambarella exclusively for their vision modules)
- Web Server: lighttpd 1.4.66
- Frontend: React SPA (minified, ~2MB bundle)
- Secondary UI: Bootstrap 5 + jQuery 3.6.0
- OS: Embedded Linux (assumed, based on lighttpd + BusyBox conventions in similar Ambarella platforms)
- Contact iENSO - Small 37-person company in Richmond Hill, ON. Contact: Vision@iENSO.com / 905-763-6938. Ask for default credentials on the EVPaaS local web interface.
- Contact Whisker support - Ask about local camera interface credentials. Likely to deflect, but worth trying.
- Physical disassembly - Look for labels on the camera module board, or UART debug pads. Ambarella SoCs typically expose a debug UART. A USB-UART adapter + serial console would yield a root shell and direct access to the credential store.
- Firmware extraction - If a firmware update file can be obtained (via the update mechanism or intercepted OTA), it could be unpacked to extract credentials or password hashes.
- MITM the cloud connection - The camera communicates with Whisker's cloud for streaming. Intercepting this traffic might reveal auth tokens or provisioning data, though it's likely TLS-pinned.
The Litter-Robot 5 Pro's camera is a fully capable IP camera with local RTSP streaming, recording, AI detection, and a complete web management interface - all running on your local network. Whisker charges a subscription (Whisker+) to access basic camera features through their cloud, but the hardware is capable of operating entirely locally.
If the login credentials can be determined:
- RTSP streaming can be enabled and pointed directly at home NVR software (Frigate, Blue Iris, etc.)
- Local recording to the camera's onboard storage becomes available
- AI detection (motion, people, vehicles) can be configured independently
- Image tuning (exposure, white balance, HDR, etc.) can be adjusted
- No cloud dependency - everything runs on the LAN
This would make the LR5 Pro camera a first-class citizen in a self-hosted smart home setup, which is exactly what the Home Assistant / Frigate community has been asking for.
If you've made progress on this or have an LR5 Pro you'd like to investigate, please comment below. Key things that would help:
- Default credentials for iENSO EVPaaS camera modules
- UART pinout for the LR5 Pro camera board
- Firmware dumps or update files
- Packet captures from the Whisker app during camera onboarding
- Any response from iENSO or Whisker regarding local access
Last updated: April 16, 2026
Oh yeah, I'm in that Reddit post. Life got busy and I neglected to post it here. My bad.
Reddit thread: https://old.reddit.com/r/LitterRobotCommunity/comments/1so135c/litterrobot_5_pro_reverse_engineering/