Wyze Cam security flaw gave hackers access to video; went unfixed for almost three years

A major Wyze Cam security flaw easily allowed hackers to access stored video, and it went unfixed for almost three years after the company was alerted to it, says a new report today.

Additionally, it appears that Wyze Cam v1 – which went on sale back in 2017 – will never be patched, so it will remain vulnerable for as long as it is used …

Bleeping Computer reports.

A Wyze Cam internet camera vulnerability allows unauthenticated, remote access to videos and images stored on local memory cards and has remained unfixed for almost three years.

The bug, which has not been assigned a CVE ID, allowed remote users to access the contents of the SD card in the camera via a webserver listening on port 80 without requiring authentication.

Upon inserting an SD card on the Wyze Cam IoT, a symlink to it is automatically created in the www directory, which is served by the webserver but without any access restrictions.

And as if that weren’t bad enough, it gets worse. Many people re-use existing SD cards they have laying around, some of which still have private data on them, especially photos. The flaw gave access to all data on the card, not just files created by the camera.

Finally, the AES encryption key is also stored on the card, potentially giving an attacker live access to the camera feed.

Altogether, Bitdefender security researchers advised the company of three vulnerabilities. It took Wyze six months to fix one, 21 months to fix another, and just under two years to patch the SD card flaw. The v1 camera still hasn’t been patched, and as the company announced last year that it has reached end-of-life status, so it appears it never will.

The same company suffered a massive security breach back in 2019 after it failed to secure customer databases stored on the internet.

A Wyze camera security breach has seen a large amount of personal data leaked for more than 2.4 million users. TwelveSecurity, which detected the breach, says it has never before seen such a serious breach.

Both the company’s production databases were left entirely open to the internet. A significant amount of sensitive information generated by 2.4 million users, all coincidentally outside of China, was the result.

If you currently have Wyze cameras, you might want to consider replacing them with another brand.