PT-2024-37480 · Wyze · Wyze Cam V3

Rafal Goryl · Published 2024-06-21 · Updated 2025-07-16 · CVE-2024-6248

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Wyze Cam v3 (affected versions not specified)

Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. The specific flaw exists within the "run action batch" endpoint of the cloud infrastructure. The issue results from the use of the device's MAC address as a sole credential for authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-6248

ZDI-24-839

Affected Products

Wyze Cam V3

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-6248 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-839 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6248 · Vendor Advisory
• https://forums.wyze.com/t/security-advisory/289256 · Vendor Advisory
• https://twitter.com/CVEnew/status/1860055233583305002 · Twitter Post
• https://twitter.com/threatmirrorsec/status/1945462205945659723 · Twitter Post