| EZVIZ C3W (CS-C3W-A0-1C2WFR)
|
|
Security Grade
Calculator v1
|
EZVIZ C3W
Release Date: 2020-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Indoor and outdoor camera housing with no public teardown reporting an exposed UART; several of the brand flaws are reachable over the local network instead of through physical access.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
Nine CVEs are recorded against the brand, including CVE-2024-42531 (CVSS 9.8, an unauthenticated host can reach the live video stream by crafting RTSP packets), CVE-2023-34551 (CVSS 8.0, stack buffer overflow in the EZVIZ SDK command server leading to remote code execution) and CVE-2023-34552 (unauthenticated remote code execution through the SADP multicast protocol). The affected firmware lists cover the CS-C3N, CS-C6N and CS-CV310 ranges that share the same platform as the C3W.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Technical details and exploit tooling are public, but EPSS stays low and none of the brand CVEs are listed in CISA KEV, so no confirmed mass exploitation was found.
|
| Updatability
|
Very common
|
🔗 Proof
|
EZVIZ publishes security notices with fixed firmware builds such as V5.3.x and delivers updates through the app.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
No
|
🔗 Proof
|
CVE-2024-42531 lets an unauthenticated host redirect and reach the live feed, and CVE-2023-48121 is an authentication bypass in the direct connection module that returns sensitive information to crafted messages.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
CVE-2026-32683 (CWE-319) shows older cloud feature modules exchanging data through legacy API interfaces that can be recovered by anyone observing the adjacent network, and the vendor asks users to enable the video encryption feature to restore confidentiality.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
No vendor documentation of encryption at rest for recordings and credentials on the device or on the microSD card.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
EZVIZ cloud account with device sharing, but no documented role separation.
|
| Authentication
|
Absent
|
🔗 Proof
|
CVE-2023-48121 is an authentication bypass and CVE-2024-42531 requires no credentials at all to reach the video stream, so authentication cannot be relied on for the local interfaces.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
No published documentation of failed-attempt lockout for the app or device access.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Recording and access history are available; no full security audit log is documented.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
A password is set during initial configuration; no enforced complexity policy is documented.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded Linux (Companion App: EZVIZ app (iOS / Android))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: microSD up to 256 GB
|
| Power, Battery & Charging
|
Battery: None • Power: 12 V DC, PoE on wired variants • Charging:
|
| Display & Camera
|
Display: • Camera: 1080p (2 MP), infrared night vision
|
| Sound & Connectivity
|
Sound: Microphone and speaker (two way audio) • Connectivity: Wi-Fi 802.11 b/g/n 2.4 GHz, Ethernet on wired variants
|
| Physical (Dimensions & Mass)
|
Dimensions: approx. 150 x 100 x 100 mm • Mass: approx. 350 g
|
Overall assessment: The C3W shares the platform of several EZVIZ models whose firmware is explicitly listed as affected. Nine CVEs are recorded against the brand, the most severe being CVE-2024-42531 (CVSS 9.8), where an unauthenticated host can reach the live video stream by crafting RTSP packets, followed by CVE-2023-34551 (CVSS 8.0, stack buffer overflow in the SDK command server) and CVE-2023-34552 (unauthenticated remote code execution over the SADP multicast protocol). CVE-2023-48121 adds an authentication bypass in the direct connection module, so local interfaces cannot be relied on to enforce identity. CVE-2026-32683 (CWE-319) shows legacy cloud API interfaces leaking data observable on the adjacent network. The mitigating factors are that none of these appear in CISA KEV, EPSS stays low and EZVIZ does publish security notices with fixed firmware builds, so the device is rated below the Amcrest camera, which has confirmed exploitation in the wild.
