| Wyze Cam v3
|
|
Security Grade
Calculator v1
|
Wyze Cam v3
Release Date: 2020-10-27 • Status: End of sale
Classification Date: 2026-10-21
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
—
|
CVE-2024-6247 requires physical presence and abuses the Wi-Fi SSID field for command injection, showing local attack paths exist; no mass physical-tampering campaign found.
|
| Known vulnerabilities
|
Very common
|
—
|
Authentication-logic bypass affecting Cam v3 (CVE-2019-9564) plus a 2024 Talos cluster: Wi-Fi driver heap overflow (CVE-2024-6246), cloud improper authentication (CVE-2024-6248) and TCP stack overflow (CVE-2024-6249).
|
| Prior attacks
|
Rare
|
—
|
Not present in CISA KEV and no public in-the-wild exploitation campaign for Cam v3 was identified.
|
| Updatability
|
Very common
|
—
|
Firmware is pushed OTA through the Wyze app and the product line has received repeated security firmware releases.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
—
|
Every device is bound to a Wyze account and authenticated through the Wyze cloud, with Alexa/Google integrations brokered by that account.
|
| Communications
|
Encrypted with obselete encryption
|
—
|
Streams use TLS, but improper authentication in the cloud infrastructure (CVE-2024-6248) means the transport protection did not guarantee the intended peer.
|
| Storage
|
No encryption
|
—
|
microSD recordings are written as plain MP4 files with no documented at-rest encryption or key management.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
—
|
Wyze account handles registration, password recovery, 2FA enrolment and device sharing.
|
| Authentication
|
Basic
|
—
|
Account password plus optional e-mail/SMS verification; TOTP 2FA is available in the app but not enforced per device.
|
| Brute-force protection
|
Basic
|
—
|
Cloud-side rate limiting exists, yet the device authentication logic itself was bypassable (CVE-2019-9564), so protection is rated basic.
|
| Event logging
|
Partial logging
|
—
|
Event/alert history is visible in the app; authentication and configuration changes are not exposed to the user as an audit trail.
|
| Passwords
|
Require change after setup with complexity requirements
|
—
|
Wyze account passwords must meet length/complexity rules and the device setup code is single-use.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Wyze embedded Linux firmware (Companion App: Wyze app (Android/iOS))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: microSD card up to 256 GB, Cam Plus cloud
|
| Power, Battery & Charging
|
Battery: • Power: 5 V/1 A USB adapter • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: 2.4 GHz Wi-Fi (802.11n), Bluetooth (setup)
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Reasoning: Cam v3 is a cheap, widely deployed camera whose 2024 Talos findings show a broad attack surface (Wi-Fi driver, TCP stack, cloud authentication) rather than a single bug. Account handling is mature and updates are frequent, but local footage is unencrypted and the cloud authentication flaw undermined transport guarantees. Scope note: rated on the final stock firmware for a cloud-connected deployment; local-only RTSP/bridge setups would score differently. The product has been superseded by Cam v4 and is assessed as end of sale.
