Wyze Cam v2

Wyze Cam v2
Security Grade C Calculator v	Wyze Cam v2 Brand: Wyze Category: Security Camera • Model / Gen: v2 Wyze Cam v2; regulatory identifier not inspected Release Date: 2018-02-18 • Status: Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[1] 🔗 Proof	ASSESSOR INFERENCE: Rare denotes local-access requirements. Power, setup and removable microSD permit physical interruption/recovery; original v2 research demonstrates a local reflash path. No tamper-proof design or measured frequency is claimed.
Known vulnerabilities	Very common	[2] 🔗 Proof	ASSESSOR INFERENCE: Very common reflects several historical authentication, memory-safety, SD-access and firmware/recovery weaknesses. It is not measured prevalence; patched v2 issues and unsupported v1 are distinguished.
Prior attacks	None	[3] 🔗 Proof	BOUNDED PUBLIC-RECORD ASSESSMENT: None means no confirmed v2-specific field botnet incident is identified in the reviewed primary studies. Laboratory firmware exploits and cloud access-control incidents are not labelled a model botnet population. This is not proof of no attacks or zero risk.
Updatability	Rare	🔗 Proof	No v2 entry newer than January 2024 was visible; update capability exists, future support unverified.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[4] 🔗 Proof	Partial describes device keys/certificates and authenticated cloud use alongside setup/recovery and historical local weaknesses. The old remote authentication bypass was patched; neither its continued presence nor universal current mutual authentication is claimed.
Communications	Encrypted with up-to-date encryption	🔗 Proof	Vendor describes TLS and AES-128 video transport; excludes unverified/custom-firmware channels.
Storage	No encryption	🔗 Proof	HISTORICAL STOCK V2 SCOPE: the original dissertation extracts SquashFS/JFFS2 from 4.9.5.36 and reads the root-password hash. This supports unencrypted filesystem elements; hashing is not filesystem encryption. It does not audit later 4.9.9.3006, every recording or all saved secrets.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Owner-only management differs from invited-user sharing permissions.
Authentication	Basic	[5] 🔗 Proof	Conservative Basic recovery-boundary rating: current cloud email login has 2FA, but original v2 research demonstrates physical replacement of a historical stock image. Cloud MFA is not proof of authenticated camera recovery on every build.
Brute-force protection	Basic	🔗 Proof	Basic, cloud-account scope: multiple firsthand 2023-2024 reports document a too-many-attempts/15-minute lockout message and inconsistent recovery. This is primary observational evidence, not a vendor-guaranteed current threshold or camera-local rate-limit test.
Event logging	Partial logging	[6] 🔗 Proof	Partial logging: motion/event recording and diagnostic records are documented. These qualify as event records under the broad rubric, but do not establish a comprehensive administrator/authentication access audit.
Passwords	Default/Common/Easy to guess	[7] 🔗 Proof	HISTORICAL DEVICE-CREDENTIAL SCOPE: the 4.9.5.36 study recovered an easily guessed built-in root credential from its hash. The 3-point rating describes that local historical credential, not current cloud passwords. Later builds and current cloud 2FA are separate and are not inferred vulnerable from this study alone.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Stock firmware, not custom RTSP firmware; reviewed v2 release entry 4.9.9.3006. (Companion App: Wyze app)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage: microSD recording; installed capacity unspecified
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Research assessment reviewed 2026-10-22. This grade is an assessor risk profile based on the stated evidence and inferences, not a test or certification of an individual installed device.

Assessment scope and limits

Stock v2, not v1/v3 or custom RTSP firmware. Latest v2 entry visible in reviewed combined history: 4.9.9.3006 (2024-01-16), requiring app 2.48+. This is not a verified lifecycle statement.

Historical vulnerability evidence, current documented capabilities and assessor inferences are identified separately in the comments. Historical-build findings are not asserted in every patched build. Configuration-dependent benefits apply only when the specified settings are enabled. The rubric does not define numerical Rare/Very common thresholds; qualitative mappings are explained.

Release date is the 18 February 2018 announcement supplied by Wyze staff; the same source says first units shipped in early April after a hardware delay. This is a research profile combining explicitly scoped historical device findings and documented cloud capabilities, not certification of the newest firmware. Wyze staff launch-date explanation

Calculation cross-check

Device CRIS 2, 3, 1, 2, CATS 2. System CRIS 2, 1, 3, CATS 2. User Authentication CRIS 2, 2, 2, 2, 3, CATS 3. GRAS 7; expected Grade C. Methodology

Historical vulnerabilities and remediation

CVE-2019-9564: Remote-connection authentication bypass

• Affected scope: Historical v2 remote-connection path; exact first vulnerable build unspecified.

• Preconditions: Reachable affected protocol and missing secret validation.

• Impact: Unauthorized control; this flaw alone does not decrypt the live stream.

• Remediation: Researchers report v2 fix on 2019-09-24; exact build not supplied.

• Severity: Numeric score not independently verified; omitted.

• Evidence: Bitdefender original Wyze research

CVE-2019-12266: Stack buffer overflow

• Affected scope: Historical camera connection path; paper includes v2; exact affected app/firmware range unspecified.

• Preconditions: Access to affected function; may chain with authentication weakness.

• Impact: Remote code execution.

• Remediation: Researchers report an app fix on 2020-11-09; exact app build not supplied.

• Severity: Numeric score not independently verified; omitted.

• Evidence: Bitdefender original Wyze research