tl;dr Default password policies for these cameras suck. This isn't about a new breach or vulnerability (which I expected at first, given the headline).