Wyze Cam v2

From Wiki-IoT
Revision as of 02:17, 22 October 2026 by Huixin Lin (talk | contribs)


Evidence review: 2026-10-21. Overall IDRS grade: not assigned.

All 12 criteria are investigated below. A documented capability, a historical vulnerability and an observed current configuration are different evidence types. Unresolved values are explicitly not scored; absence of a public report is not evidence of absence.

Classification form fields are stored in this page. The evidence table is displayed while required ratings remain unresolved, so no overall grade is assigned. Blank rating choices mean insufficient evidence, not None or Absent.

Product information

Field Verified value / stated scope
Name Wyze Cam v2
Brand Wyze
Model Wyze Cam v2; regulatory identifier not inspected
Generation v2
Operating System Stock firmware, not custom RTSP firmware; reviewed v2 release entry 4.9.9.3006.
Companion App Wyze app
Storage microSD recording; installed capacity unspecified
Type Security Camera
Website https://support.wyze.com/hc/en-us/articles/7990737435547-Wyze-Cam-v1-v2-Pan-Features

Assessment scope

Stock v2, not v1/v3 or custom RTSP firmware. Latest v2 entry visible in reviewed combined history: 4.9.9.3006 (2024-01-16), requiring app 2.48+. This is not a verified lifecycle statement.

No physical device, installed firmware, password, network trace or storage image was inspected. Conditional capability assessments apply only when the named settings are enabled.

Security evaluation

Device

Criterion Finding / rubric choice Evidence and reasoning
Known hardware tampering Removable microSD and exposed power; not rated Wyze documents microSD recording and physical setup interfaces. These show physical access concerns; no measured model-specific tampering frequency was established. Wyze v1/v2/Pan features Wyze microSD guide
Known vulnerabilities Confirmed vulnerabilities; frequency not quantified The records below establish historical vulnerabilities within the stated firmware scope. They do not measure prevalence or establish a Rare/Very common frequency rating. Bitdefender original Wyze research
Prior attacks Not rated: insufficient evidence Model-specific field-attack frequency was not established. Research demonstrations are not incident counts. Bitdefender original Wyze research
Updatability Rare (CRIS 2; scoped assessment) No v2 entry newer than January 2024 was visible; update capability exists, future support unverified. Wyze firmware history

System

Criterion Finding / rubric choice Evidence and reasoning
Authentication with other systems Not rated: insufficient evidence Vendor describes device keys/certificates; historical bypass and current mutual authentication must be separated. Wyze security/privacy Bitdefender original Wyze research
Communications Encrypted with up-to-date encryption (CRIS 1; scoped assessment) Vendor describes TLS and AES-128 video transport; excludes unverified/custom-firmware channels. Wyze security/privacy
Storage Not rated: insufficient evidence Transport encryption does not prove microSD encryption; current at-rest protection unverified. The methodology refers specifically to device flash, not just user disks, removable media, or encrypted network traffic. Wyze microSD guide Wyze security/privacy

User authentication

Criterion Finding / rubric choice Evidence and reasoning
Account management Basic (CRIS 2; scoped assessment) Owner-only management differs from invited-user sharing permissions. Wyze security and sharing
Authentication Secure cloud account flow; device recovery separate (CRIS 1; scoped assessment) The current email-account setup automatically enables email 2FA for subsequent app logins. This supports the cloud-login assessment only; third-party sign-in and local camera/recovery paths are not covered by the claim. Wyze account creation guide, March 2026
Brute-force protection Not rated: insufficient evidence Camera/cloud failed-login thresholds were not verified; 2FA is not a throttling proof. Wyze account/password Wyze 2FA changes
Event logging Not rated: insufficient evidence Diagnostic logs existed historically; current authentication audit logging was not established. Bitdefender original Wyze research Wyze v1/v2/Pan features
Passwords Setup-created account password; cloud policy documented The March 2026 account guide documents a user-created password of at least ten characters with upper/lower case and a special character, excluding simple sequences/spaces. This describes the email-account flow; Google/Apple login is separate. No shared camera factory-login password is inferred. Wyze account creation guide, March 2026

Rating calculation

No definitive category score or GRAS is calculated while one or more required CRIS values are unresolved. The method requires taking the ceiling of each complete category mean and summing the three category scores. An unknown must not be substituted with 1 or treated as None. Wiki-IoT methodology

Historical vulnerabilities and remediation

CVE-2019-9564: Remote-connection authentication bypass

  • Affected scope: Historical v2 remote-connection path; exact first vulnerable build unspecified.
  • Preconditions: Reachable affected protocol and missing secret validation.
  • Impact: Unauthorized control; this flaw alone does not decrypt the live stream.
  • Remediation: Researchers report v2 fix on 2019-09-24; exact build not supplied.
  • Severity: Numeric score not independently verified; omitted.

CVE-2019-12266: Stack buffer overflow

  • Affected scope: Historical camera connection path; paper includes v2; exact affected app/firmware range unspecified.
  • Preconditions: Access to affected function; may chain with authentication weakness.
  • Impact: Remote code execution.
  • Remediation: Researchers report an app fix on 2020-11-09; exact app build not supplied.
  • Severity: Numeric score not independently verified; omitted.

Product evidence notes

Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=Wyze_Cam_v2&oldid=8675"