A PoC for upgrading firmware via DNS hijacking on a Momentum IP camera
It is possible to upgrade the firmware on Momentum IP camera by changing /etc/resolv.conf to the attacker's DNS server, then hosting this https-server.py page with firmware upgrade instructions.
For more information see https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf