Wyze’s original and recently discontinued Cam v1 suffers from a flaw that allows attackers to view the contents of the camera’s SD card, according to security researchers.
Cybersecurity firm Bitdefender (via BleepingComputer) has published a white paper detailing the security hole, which lets hackers access the original Wyze Cam’s SD card by exploiting a webserver vulnerability.
The bug was first reported back in March 2019, Bleeping Computer reports, and Wyze finally patched the security hole for the Wyze Cam v2 and v3 just two months ago. But the flaw remains unpatched in the original Wyze Cam, which Wyze “retired” on February 1.
Notably, Wyze said that it was discontinuing the Wyze Cam v1 because it “can no longer support a necessary security update.”
Wyze added that while users of the first Wyze Cam, which will receive no future security patches, would still be able to use the camera, doing so “carries increased risk, is discouraged by Wyze and is entirely at your own risk.”
It’s not clear if the “necessary security update” that Wyze was referring to was the patch that Wyze released for the SD card flaw in January. We’ve reached out to Wyze for comment.
As BleepingComputer notes, the SD card on a Wyze Cam stores a variety of information beyond recorded video footage, including the device’s log files and UUID (universally unique identifier number).
In a blanket recommendation, Bitdefender says that smart home users should “keep a close eye on IoT devices” as well as “isolate them as much as possible from the local or guest network.”
But given what appears to be a pretty serious security vulnerability that will likely never be patched, users of the Wyze Cam v1 should probably go ahead and toss their obsolete cameras in the e-cycle bin.
