Wyze has finally released fixes for vulnerabilities which could give attackers direct access to live video feeds and stored recordings in their smart cameras.
Researchers at Bitdefender discovered the first of three vulnerabilities back in 2019 and then waited over a year and a half to report on the third as Wyze had not produced a fix. The three vulnerabilities, which all need local network access to exploit, are:
- Authentication bypass (CVE-2019-9564)
- Remote control execution flaw caused by a stack-based buffer overflow (CVE-2019-12266)
- Unauthenticated access to contents of the SD card
The patches are only available for versions 2 and 3 of the Wyze Cam, the discontinued version 1 is not receiving a fix leaving the devices vulnerable to remote take-over. Users of Wyze smart cams can update the firmware using the supplied app from Wyze.
The research paper from Bitdefender unpacks the three flaws in more details.
Smart or IoT devices should be deployed with caution and viewed as disposable in many circumstances. Like the version 1 of the Wyze cam which Wyze admits didn’t have enough on-device memory to allow them to produce a security patch so they simply discontinued the product and left the flaw unresolved. If IoT devices are used in your business, wise security managers will treat them all as untrusted and keep them isolated on a separate network segment away from your core network.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)