Read the docs
TI-2019-06985 Aliases CVE-2019-9564GHSA-vvr6-jfrg-g7cr

Authentication bypass in Wyze Cam Pan v2, Cam v2 and Cam v3

Priority MEDIUM 45CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

A vulnerability in the authentication logic of Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to bypass login and control the devices. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32.

Why it matters now

EPSS 0.01419 72nd percentileScored 2026-11-07
Fix Fixed Cam Pan v2 (Wyze): 4.49.1.47Cam v2 (Wyze): 4.9.8.1002+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
WyzeCam Pan v2before 4.49.1.474.49.1.47Patch availableCNA
WyzeCam v2before 4.9.8.10024.9.8.1002Patch availableCNA
WyzeCam v3before 4.36.8.324.36.8.32Patch availableCNA
  • Cam Pan v2 VendorWyze Affected before 4.49.1.47 Fixed in 4.49.1.47 Patch available CNA
  • Cam v2 VendorWyze Affected before 4.9.8.1002 Fixed in 4.9.8.1002 Patch available CNA
  • Cam v3 VendorWyze Affected before 4.36.8.32 Fixed in 4.36.8.32 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:wyze:cam_pan_v2_firmware:*:*:*:*:*:*:*:*before 4.49.1.47VulnerableWyze
cpe:2.3:h:wyze:cam_pan_v2:-:*:*:*:*:*:*:*not specified by NVDRunning onWyze
cpe:2.3:o:wyze:cam_v2_firmware:*:*:*:*:*:*:*:*before 4.9.8.1002VulnerableWyze
cpe:2.3:h:wyze:cam_v2:-:*:*:*:*:*:*:*not specified by NVDRunning onWyze
cpe:2.3:o:wyze:cam_v3_firmware:*:*:*:*:*:*:*:*before 4.36.8.32VulnerableWyze
cpe:2.3:h:wyze:cam_v3:-:*:*:*:*:*:*:*not specified by NVDRunning onWyze
  • cpe:2.3:o:wyze:cam_pan_v2_firmware:*:*:*:*:*:*:*:* Versions before 4.49.1.47 Vulnerable ·Wyze
  • cpe:2.3:h:wyze:cam_pan_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wyze
  • cpe:2.3:o:wyze:cam_v2_firmware:*:*:*:*:*:*:*:* Versions before 4.9.8.1002 Vulnerable ·Wyze
  • cpe:2.3:h:wyze:cam_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wyze
  • cpe:2.3:o:wyze:cam_v3_firmware:*:*:*:*:*:*:*:* Versions before 4.36.8.32 Vulnerable ·Wyze
  • cpe:2.3:h:wyze:cam_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wyze

Remediation

  • Fix · CNA Cam Pan v2 (Wyze) Fixed in 4.49.1.47
  • Fix · CNA Cam v2 (Wyze) Fixed in 4.9.8.1002
  • Fix · CNA Cam v3 (Wyze) Fixed in 4.36.8.32

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Wyze Cam Pan v2, Cam v2, Cam v3 4.36.8.32, 4.49.1.47, 4.9.8.1002

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2019-09154 Stack buffer overflow in Wyze Cam Pan v2, Cam v2 and Cam v3Priority MEDIUM 45
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-9564
  2. 2026-10-03 Alias added: GHSA-vvr6-jfrg-g7cr

References

Advisory 1

  • TI-2019-09154 Stack buffer overflow in Wyze Cam Pan v2, Cam v2 and Cam v3 CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences