| Xiaomi Mi Home Security Camera PTZ 2K (MJSXJ06CM)
|
|
Security Grade
Calculator v1
|
Xiaomi Mi Home Security Camera PTZ 2K
Category: Camera • Model / Gen: MJSXJ06CM
Release Date: 2021-04-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
—
|
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
|
| Prior attacks
|
Rare
|
🔗 Proof
|
|
| Updatability
|
None
|
—
|
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
—
|
|
| Communications
|
Encrypted with obselete encryption
|
—
|
|
| Storage
|
No encryption
|
—
|
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
—
|
|
| Authentication
|
Basic
|
🔗 Proof
|
|
| Brute-force protection
|
Absent
|
—
|
|
| Event logging
|
Partial logging
|
—
|
|
| Passwords
|
Default/Common/Easy to guess
|
—
|
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Linux (RTOS based) (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: ARM Cortex-A7 • GPU: None
|
| Memory & Storage
|
Memory: 128 MB RAM • Storage: 128 MB Flash, supports MicroSD
|
| Power, Battery & Charging
|
Battery: None • Power: 5V DC adapter • Charging:
|
| Display & Camera
|
Display: None • Camera: 2K (2304 x 1296)
|
| Sound & Connectivity
|
Sound: None • Connectivity: 2.4GHz Wi-Fi, Ethernet
|
| Physical (Dimensions & Mass)
|
Dimensions: None • Mass: None
|
CVE-2022-27529 is an authentication bypass vulnerability in Xiaomi Mi Home Security Camera 2K (CVSS 8.1, High). An unauthenticated attacker on the local network can access the camera's video stream without a password, and some firmware versions allow the device to be added to a stranger's account. Because the camera points at the inside of the home, a compromise directly exposes the family's daily life, and the footage can be viewed in real time. The device receives firmware updates rarely, so the flaw stays open for a long time.
