Hackable IP Cameras

Last updated 2026-09-21 · updated weekly by an automated research job · run #7.

The verdicts

This topic judges "best" along 6 axes, each with its own standing verdict and history.

Cheap flashable

Judged on: Best camera under ~$25 that can be flashed with open firmware (Thingino or OpenIPC) with no soldering or UART, and that streams RTSP into go2rtc/Frigate TODAY. Judged on: currently buyable at that price, a no-tool installer that works on the hardware revision actually shipping, and no known stream-stability regression. A model whose current retail units fail to flash does not hold this facet no matter how good it was.

The current state of the art for Cheap flashable, as of 2026-08-24 (confidence secondary):

The Cinnado D1 remains the default recommendation at ~$15 with a no-tool SD-card installer, but recent reports indicate newer units with a T23N SoC may fail sensor detection during installation. The Wansview Q5 is a community-verified alternative at ~$20.

Contenders:

• Cinnado D1 — Cheapest no-tool flashable camera, but current retail units may have installation issues.
• Wansview Q5 — Community-verified to work with Cinnado D1 installer, widely available on Amazon.
• Jooan A2R-U — Extremely cheap ($3-10) but requires a programmer, not a no-tool install.

Stills on demand

Judged on: Best camera for pulling a single frame when asked, rather than holding a continuous stream — snapshot/still endpoint, JPEG on request, wake-on-ask. Judged on image quality per dollar, how simply a still can be fetched over plain HTTP, and whether it can idle cheaply between captures. MJPEG-only and low-framerate hardware is fully competitive here, and battery duty cycles that lose to continuous streaming can win this facet outright.

The current state of the art for Stills on demand, as of 2026-09-21 (confidence unverified):

No verdict can be established yet. The tracked items and this run's results contain no information about cameras optimized for pulling single frames on demand via HTTP or a simple endpoint.

Stock RTSP

Judged on: Best camera that speaks RTSP and/or ONVIF on its shipped firmware with no flashing at all. Judged on price, whether ONVIF is genuinely present (not just RTSP), and reliability in go2rtc/Frigate. This facet sets the price ceiling the flashable tier has to beat — if flashing buys nothing, say so.

The current state of the art for Stock RTSP, as of 2026-08-24 (confidence secondary):

The Sonoff CAM Slim Gen2 provides RTSP and ONVIF on its stock firmware for ~$20. The Wyze Cam v3 has a beta firmware adding RTSP support, but it's not a stable release. The Reolink RLC-520A is a reliable, higher-end PoE option with ONVIF.

Contenders:

• Sonoff CAM Slim Gen2 (CAM-S2) — Cheapest confirmed stock RTSP/ONVIF camera at ~$20.
• Wyze Cam v3 — Beta firmware adds RTSP; excellent low-light sensor.
• Reolink RLC-520A — Reliable, higher-quality 5MP PoE camera with ONVIF.

Wired / PoE

Judged on: Best Ethernet-native or PoE camera we can own — open firmware preferred, stock RTSP/ONVIF acceptable. Judged on price at commodity retail (US availability counts; AliExpress-only is a weaker claim), and on how much work the install costs: UART and flash-glitching is a real price.

The current state of the art for Wired / PoE, as of 2026-08-24 (confidence secondary):

Vanhua modules (L34/H33/FJZ/Z55) on AliExpress remain the only Ethernet-native Thingino targets, requiring UART and a flash-glitch. No commodity PoE camera has reached the Amazon-US tier with a no-tool flashing method.

Contenders:

• Vanhua L34 / H33 / FJZ / Z55 — Only confirmed Ethernet/PoE-capable Thingino targets, but require advanced flashing.
• Reolink RLC-520A — Stock PoE camera with ONVIF, no flashing required, but more expensive.

Compact

Judged on: Smallest camera we can actually own and stream from — physical size is the criterion, subject to the hard floor of a local stream or still we control (no vendor cloud, no phone-app-only). Bare modules and boards count if they are buyable and flashable. Cloud-P2P cubes never qualify however small they are.

The current state of the art for Compact, as of 2026-09-21 (confidence unverified):

No verdict can be established yet. The tracked items include small modules (OpenIPC FPV AIO, XM bare boards) and the TOP-201 cube, but there is insufficient information on current availability, pricing, and ease of flashing to declare a smallest viable camera.

Battery

Judged on: Best battery-powered camera usable on our own terms — WiFi station mode plus RTSP/ONVIF or an on-demand still, with runtime measured in real hours. Judged on runtime under actual use, not standby claims. The standing answer has been "the category is empty"; keep testing whether that is still true, and say plainly when it is.

The current state of the art for Battery, as of 2026-08-24 (confidence secondary):

The category remains effectively empty. The OpenIPC FPV AIO boards are battery-powered but stream via wfb-ng, not RTSP/ONVIF, making them incompatible with standard NVR software like Frigate. No retail battery-powered camera offers usable RTSP with open firmware.

Contenders:

• OpenIPC FPV AIO boards (Mario / Thinker) — Only battery-powered OpenIPC hardware, but uses wfb-ng protocol, not RTSP.

What this is, and how it works

This page is generated, not written. A scheduled job runs weekly on a machine in a homelab. Each run it:

1. Searches the open web for both the products already tracked here and for category-level terms designed to turn up ones we've never heard of.
2. Feeds those results to a language model along with everything already on this page, and asks it what is genuinely new. Finding nothing is an acceptable answer, and most runs should find little.
3. Writes the result into a versioned JSON dataset (data/live-research/hackable-ip-cameras.json) and commits it. This page is re-rendered from that file.

So: a machine wrote the prose here. Every changelog entry carries at least one source link, and every item and entry carries a confidence label:

• primary-source — vendor documentation, a published paper, or a regulator.
• secondary — reputable press.
• vendor-claim — marketing or an unreplicated vendor statement.
• unverified — a single low-quality source, usually auto-discovered.

Any label weaker than primary-source is printed beside the finding, so an unflagged row is a primary source. A tracker that hides its own uncertainty is worse than no tracker.

What this is not. Not medical advice. Not a review site — nothing here has been tested in our hands. No affiliate relationships, no sponsored placements, nothing bought. Vendor claims are attributed to the vendor rather than restated as findings. Where a price, a date, or a regulatory status is unknown, it is left blank instead of guessed.

What's new

6 developments in the last 30 days, newest first.

The last 30 days

No new Thingino cameras were added to the official supported hardware list this month. The biggest development is a negative one: the LSC 3215672 camera, a previously known Thingino target, now ships with a different, incompatible Anyka chipset, demonstrating that hardware revisions can silently break compatibility. Another regression surfaced for the Cinnado D1, where some users report the password they set during initial Thingino setup is later rejected.

Existing problems persist. The Wansview Q5's stock firmware contains a 20-year-old vulnerability, and the Sonoff CAM-S2 continues to have software issues according to its own user forum. For flashed cameras, ONVIF event forwarding to Scrypted is broken, requiring software motion detection as a workaround, and stream stability with Frigate/go2rtc remains a topic of ongoing discussion and workarounds.

On the OpenIPC side, the project's open wall shows a Hi3518EV200 camera running its firmware, confirming active use. A separate, unverified custom firmware project called "yi-hack-v5" targeting the same HiSilicon chipset was mentioned in a forum post. The Ingenic T41, which powers the reported Noorio T110, is being marketed by the chipmaker for next-gen AI cameras.

If you're buying, stick to the known, verified models like the Cinnado D1 or Wyze v3 and run ipctool first to confirm the hardware. Assume any new, unlisted camera is a gamble that could have a silent hardware change.

Written 2026-09-21 from the changelog below, not from a fresh search.

Drawn from:

• OpenIPC Open Wall shows a HI3518EV200 + JXF23 camera running firmware 2.4.02.01-lite. — 2026-09-21, confidence primary-source
• LSC 3215672 camera from Action Market has a silent hardware revision, now incompatible with Thingino. — 2026-09-14, confidence primary-source
• Scrypted NVR reports ONVIF event recording failure with Thingino firmware on Wyze Cam v3. — 2026-09-14, confidence primary-source
• Cinnado D1 users report invalid password after Thingino flash. — 2026-09-07, confidence primary-source
• Galayou G7 reported as a cheap stock RTSP camera. — 2026-09-07, confidence secondary
• New custom firmware 'yi-hack-v5' for Hi3518ev200-based Xiaomi/Yi cameras. — 2026-09-07, confidence secondary

The last year

The last year saw no new Thingino-supported models officially added to its repository, leaving the list at 87 model headings as of August 2026. The most significant movement was negative: the previously reliable Cinnado D1, the default recommendation, is now a gamble. Newer units with the T23N SoC are failing Thingino installation due to an unexpected sensor mismatch, and a separate issue shows users setting passwords during initial setup only to have them rejected later. This erodes the core value proposition of a known-good, no-tool flash. For those who do get it running, stability remains a problem. Thingino streams continue to drop with 'handle error=EOF', crashing Frigate ingest; issue #967 was closed without a documented fix, and community workarounds like disabling audio or avoiding substreams are the current solution. Separately, the project's own website claims 166 supported cameras, a major discrepancy from the repo that has not been explained.

Beyond the Cinnado, the landscape of flashable hardware is static. The Wansview Q5 remains a community-verified alternative, but a security analysis found its stock firmware contains a 20-year-old directory traversal vulnerability, a stark reminder of why flashing is desirable. Two new WUUK models (Y0310, Y0510) and the Noorio T110 were reported as being tested or supported in forum posts, but these are unverified and not yet in the official documentation. The Noorio note is interesting as it uses the newer Ingenic T41NQ SoC, which Ingenic's marketing promotes for "AI on Video," but this is just a vendor claim with no functional open firmware yet. The only other development is the confirmation that OpenIPC's FPV AIO boards still only speak the wfb-ng protocol, not RTSP, keeping them in a niche separate from security camera use.

On the stock firmware front, there were minor updates. Wyze released a beta for the discontinued Cam v3 adding native RTSP support, which reduces the imperative to flash it. The Sonoff CAM Slim Gen2 was confirmed to offer RTSP and ONVIF out of the box, though users report persistent software bugs in its official app. A new contender, the Galayou G7, was mentioned as a cheap stock RTSP camera, but this is an unverified secondary report. Similarly, a new "yi-hack-v5" firmware for older Hi3518ev200 cameras was noted, but its status and relation to OpenIPC are unclear.

The core constraints remain unchanged: there is still no battery-powered, RTSP-streaming camera in this ecosystem, no commodity PoE at the Amazon price tier, and nearly everything is 2.4GHz-only. For someone deciding where to spend money now, the Cinnado D1 is no longer a safe, one-click purchase. The honest alternative for a reliable, out-of-the-box feed is still something like the Reolink RLC-520A for PoE or hunting for a used Wyze v3 and either using the new beta firmware or accepting the stream stability risks of Thingino. The open firmware projects themselves are in maintenance mode, with Thingino's stable branch receiving minor package updates but no expansion of its supported hardware list.

Written 2026-09-07 from the changelog below, not from a fresh search.

The ones that mattered:

• 2026-09-14 — LSC 3215672 camera from Action Market has a silent hardware revision, now incompatible with Thingino. (negative, primary-source)
• 2026-09-14 — Scrypted NVR reports ONVIF event recording failure with Thingino firmware on Wyze Cam v3. (negative, primary-source)
• 2026-09-07 — Cinnado D1 users report invalid password after Thingino flash. (negative, primary-source)
• 2026-08-24 — Wansview Q5 firmware contains a 20-year-old directory traversal vulnerability. (negative, secondary)
• 2026-08-24 — Users report persistent software problems with Sonoff CAM-S2. (negative, secondary)
• 2026-08-24 — Ongoing discussion of Thingino stream stability issues with Frigate and go2rtc. (negative, secondary)
• 2026-08-17 — Thingino issue #967 about streams dropping with 'handle error=EOF' and crashing Frigate was closed without a documented fix. (negative, primary-source)
• 2026-08-17 — Latest Cinnado D1 (T23N) units from Amazon fail Thingino installation due to sensor mismatch. (negative, primary-source)

All time

The field of flashable IP cameras is currently defined by two projects: Thingino, which targets specific retail models with Ingenic chips, and OpenIPC, which supports a broader range of SoCs. The recurring question—"are there any NEW Thingino cameras?"—has a negative answer for this window. Instead, the news is about regressions and stock firmware improvements that change the calculus for buyers.

The biggest negative finding is that the Cinnado D1, the default $12 recommendation, is now a gamble. Newer units with the T23N SoC are failing Thingino installation due to an unexpected sensor mismatch, as reported in a primary-source GitHub issue. Until this is resolved, you cannot reliably buy a Cinnado D1 and expect it to flash. The workaround is the Wansview Q5, which is community-verified to work with the Cinnado installer, but this is a secondary-source claim. Separately, a persistent Thingino streaming issue causing crashes in Frigate was closed without a documented fix, indicating the underlying instability in the raptor streamer on the master branch remains.

In positive but complicating news, two stock cameras have improved. Wyze released a beta firmware for the Cam v3 that adds native RTSP support and easier Wi-Fi configuration. Since the v3 is discontinued, this makes finding a used unit more attractive if you want to avoid flashing entirely. Furthermore, the Sonoff CAM Slim Gen2 (CAM-S2) is confirmed to support both RTSP and ONVIF on its stock firmware, making it a viable plug-and-play option at $20.

The established map otherwise holds: there are no new no-tool installers or supported models. Thingino remains Ingenic-only and model-specific. OpenIPC covers more chipsets but its Majestic streamer is closed-source. There is still no battery-powered, RTSP-streaming camera; the OpenIPC FPV boards are for drones. PoE options are still limited to the Vanhua modules requiring UART work. The A9 mini cloud cubes remain a dead end, and the Xiaomi Dafang hacks are obsolete.

For someone deciding where to spend money today: if you need reliability and ONVIF, the stock Sonoff CAM-S2 or a used Wyze Cam v3 on its new beta firmware are now stronger contenders. If you insist on open firmware, the Cinnado D1 is currently broken for new purchases, so you must look to the Wansview Q5 or accept the risk. For any application, run ipctool on the stock firmware first to verify the hardware; model numbers are meaningless.

Written 2026-08-17 from the changelog below, not from a fresh search.

How the field breaks down, by what we're actually tracking:

• thingino-camera — 11 items: Cinnado D1, Wansview Q5, Wyze Cam v3, Sonoff CAM Slim Gen2 (CAM-S2), Jooan A2R-U, Vanhua L34 / H33 / FJZ / Z55, Wyze Video Doorbell v1 (WVDB1), Wyze Cam Floodlight v1, WUUK Y0310, WUUK Y0510, Noorio T110.
• firmware-project — 3 items: Thingino, OpenIPC, yi-hack-v5.
• module — 2 items: OpenIPC FPV AIO boards (Mario / Thinker), XM/Xiongmai bare camera boards.
• tooling — 2 items: OpenIPC ipctool, wltechblog/thingino-installers.
• stock-rtsp — 2 items: Reolink RLC-520A, Galayou G7.
• dead-end — 2 items: "A9" mini cloud-P2P cameras, EliasKotlyar/Xiaomi-Dafang-Hacks.
• openipc-camera — 1 item: TOP TOP-201 / MCO-720P.
• esp32 — 1 item: ESP32-P4 hardware H.264.

Gone quiet or discontinued. Kept here rather than deleted, because a tracker that removes its failures is a product page:

• TOP TOP-201 / MCO-720P — The smallest OpenIPC-listed retail camera — a ~3.6cm cube, HI3518EV100 + OV9712, Ethernet only, no WiFi/USB/SD. Circa-2014 bargain unit; current retail availability unconfirmed and it looks like used/NOS market only. Last activity 2026-08-17.
• "A9" mini cloud-P2P cameras — A KNOWN DEAD END — do not recommend. "A9" is a body shape, not a product: identical $8–20 cubes ship with different SoCs and different cloud-P2P apps (V720, LookCam, YsxLite, HDWifiCamPro, JXLCAM). No RTSP, no ONVIF, no open firmware, ~200–400mAh of battery. Treat as hostile hardware. Last activity 2026-08-17.
• EliasKotlyar/Xiaomi-Dafang-Hacks — The original Ingenic T10/T20 hack for the Xiaofang/Dafang, 4.3k stars and last pushed 2024-11-25. Superseded by Thingino, which supports those cameras directly. Do not start here. Last activity 2026-08-17.

Tracked products

Available now. Price and regulatory status are blank where we have not read them on a primary source — they are never inferred.

Upcoming

Announced, no date.

Nothing in this bucket right now.

Coming Soon

Announced with a date, or an open pre-order.

Nothing in this bucket right now.

What We're Watching

Exists, unproven, or newly discovered. This is where auto-discovered items land.

OpenIPC FPV AIO boards (Mario / Thinker)

The only genuinely battery-powered, continuously-streaming OpenIPC hardware — bare 30×32mm SSC338Q boards run off a 2S–6S drone LiPo. They speak wfb-ng, not RTSP, so nothing go2rtc or Frigate can consume.

First seen 2026-08-17 · confidence primary-source · module

Why it's here: OpenIPC digital FPV guide updated for 2026, confirms wfb-ng protocol. (2026-08-18) — A 2026 guide reaffirms OpenIPC for FPV uses H.265 and broadcasts via wfb-ng (WiFi Forked Broadcast), not RTSP, making it incompatible with standard NVR software.

Sources: FPV Mario AIO docs · FPV Thinker AIO docs

XM/Xiongmai bare camera boards

~38×38mm OEM camera PCBs listed in OpenIPC's wiki by printed board code (e.g. BLK18EV-0002-2035-38X38-V1.01) — no enclosure, embed them yourself. No pricing or purchase links in the wiki; they circulate on AliExpress.

First seen 2026-08-17 · confidence primary-source · module

Why it's here: No changelog entry explains this status yet.

Sources: OpenIPC supported devices wiki

ESP32-P4 hardware H.264

The P4 has a hardware H.264 encoder rated 1080p30 plus MIPI-CSI with ISP, and Espressif's own examples do RTSP at ~15fps. ESPHome support for the encoder is UNCONFIRMED — if it lands, the whole ESP32-CAM verdict changes.

First seen 2026-08-17 · confidence primary-source · esp32

Why it's here: No changelog entry explains this status yet.

Sources: ESP-VISION H.264 docs · ESP32-P4 SoC

WUUK Y0310

Ingenic T31X IP camera with SC401AI sensor, reported as Thingino-supported.

First seen 2026-08-18 · confidence unverified · thingino-camera

Why it's here: No changelog entry explains this status yet.

Sources: none recorded — this item is a name we've seen and not much more.

WUUK Y0510

Ingenic T31X IP camera with SC401AI sensor, reported as Thingino-supported.

First seen 2026-08-18 · confidence unverified · thingino-camera

Why it's here: No changelog entry explains this status yet.

Sources: none recorded — this item is a name we've seen and not much more.

Noorio T110

Reported as being tested by Thingino, uses Ingenic T41NQ SoC with GC4023 4MP sensor.

First seen 2026-08-18 · confidence unverified · thingino-camera

Why it's here: Ingenic T41 SoC marketed as basis for next-gen AOV (AI on Video) cameras. (2026-08-31) — Ingenic's marketing describes the T41 as enabling a 'revolutionary surveillance experience' and notes Meari has integrated it into products.

Sources: none recorded — this item is a name we've seen and not much more.

Galayou G7

Reported as a cheap off-the-shelf RTSP camera.

First seen 2026-09-07 · confidence unverified · stock-rtsp

Why it's here: No changelog entry explains this status yet.

Sources: Home Assistant Community Post

yi-hack-v5

Custom firmware for Xiaomi/Yi cameras based on Hi3518ev200 chipset, adding RTSP and ONVIF.

First seen 2026-09-07 · confidence unverified · firmware-project

Why it's here: No changelog entry explains this status yet.

Sources: GitHub Repository

Promising

Early-stage, but the evidence or the approach is genuinely interesting. The only editorial bucket on this page — an item only lands here with a reason recorded in the changelog.

Nothing in this bucket right now.

Open questions

Publishing what we don't know is the point. These are things the job is actively watching for; when one gets answered it becomes a changelog entry and moves down here to the answered list.

• Has a PoE or Ethernet-native Thingino-supported camera reached the commodity Amazon-US tier? As of 2026-08-03 only Vanhua modules on AliExpress qualify, and they need UART plus a flash-glitch. — open since 2026-08-17.
• Does ESPHome support the ESP32-P4's hardware H.264 encoder yet? The silicon is confirmed at the Espressif level; ESPHome support is not. — open since 2026-08-17.
• Is there a Thingino-supported camera with 5GHz WiFi worth buying? Only "a couple" of supported devices do 5GHz and the one named — the Wansview G6 bulb-format camera — is the installer maintainer's own least favourite. — open since 2026-08-17.

Answered:

• Has any battery-powered camera usable as a security camera (WiFi station mode, RTSP or ONVIF) become flashable with Thingino or OpenIPC? As of 2026-08-03 the category is empty for DIRECT-INGEST purposes — battery cams use Sonix-class silicon neither project supports, and the sleep/wake duty cycle fights continuous streaming. Note the earlier framing here was too strong: OpenIPC FPV/VTX boards ARE battery-powered and continuously streaming, and were excluded on protocol rather than capability. Past a wfb-ng ground station they are an ordinary UDP h.264 source. They are tracked as of 2026-09-09 in live-research/wfb-video-links.yaml; what remains genuinely empty is a battery camera that speaks RTSP/ONVIF with no intermediate ground station. — answered 2026-08-18.
• Was themactep/thingino-firmware#967 — Thingino streams dropping with handle error=EOF and crashing Frigate, suspected audio-related — ever actually fixed? The issue was closed without a documented fix. — answered 2026-08-17.
• Why does thingino.com claim 166 cameras when supported_hardware.md contains 87 ### model headings? Re-counted twice from the raw blob. Unreconciled — and it matters, because the repo doc is what you shop against. — answered 2026-08-18.

Full changelog

Everything, newest first, grouped by the month we found it. Long by design — it's the receipts.

September 2026

August 2026

Dreamlab Live Research uses autonomous systems to track the state of the art in fields of interest. New trackers appear as the interests do.

Generated from a versioned dataset in a git repository: every state this page has ever been in is a commit, and a bad run is revertible. The dataset is the source; this page is build output and is not itself edited.

• Dataset: data/live-research/hackable-ip-cameras.json (schema version 2)
• Runs completed: 7 · cadence: weekly
• Items tracked: 24 · changelog entries: 18
• Distinct sources seen: 215
• Last run recorded: 2026-09-21T05:42:19Z (status: ok)