You do not have permission to edit this page, for the following reasons:
Overall assessment: The C3W shares the platform of several EZVIZ models whose firmware is explicitly listed as affected. Nine CVEs are recorded against the brand, the most severe being CVE-2024-42531 (CVSS 9.8), where an unauthenticated host can reach the live video stream by crafting RTSP packets, followed by CVE-2023-34551 (CVSS 8.0, stack buffer overflow in the SDK command server) and CVE-2023-34552 (unauthenticated remote code execution over the SADP multicast protocol). CVE-2023-48121 adds an authentication bypass in the direct connection module, so local interfaces cannot be relied on to enforce identity. CVE-2026-32683 (CWE-319) shows legacy cloud API interfaces leaking data observable on the adjacent network. The mitigating factors are that none of these appear in CISA KEV, EPSS stays low and EZVIZ does publish security notices with fixed firmware builds, so the device is rated below the Amcrest camera, which has confirmed exploitation in the wild. [[Category:Classification]] [[Category:Calculator v1]] [[Category:EZVIZ]]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
