Stack buffer overflow in Wyze Cam Pan v2, Cam v2 and Cam v3
Priority MEDIUM 45CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
Stack-based Buffer Overflow vulnerability in Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to run arbitrary code on the affected device. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32.
Why it matters now
EPSS 0.01248 69th percentileScored 2026-11-07
Fix Fixed Cam Pan v2 (Wyze): 4.49.1.47Cam v2 (Wyze): 4.9.8.1002+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Wyze | Cam Pan v2 | before 4.49.1.47 | 4.49.1.47 | Patch available | CNA |
| Wyze | Cam v2 | before 4.9.8.1002 | 4.9.8.1002 | Patch available | CNA |
| Wyze | Cam v3 | before 4.36.8.32 | 4.36.8.32 | Patch available | CNA |
- Cam Pan v2 VendorWyze Affected before 4.49.1.47 Fixed in 4.49.1.47 Patch available CNA
- Cam v2 VendorWyze Affected before 4.9.8.1002 Fixed in 4.9.8.1002 Patch available CNA
- Cam v3 VendorWyze Affected before 4.36.8.32 Fixed in 4.36.8.32 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:wyze:cam_pan_v2_firmware:*:*:*:*:*:*:*:* | before 4.49.1.47 | Vulnerable | Wyze |
| cpe:2.3:h:wyze:cam_pan_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wyze |
| cpe:2.3:o:wyze:cam_v2_firmware:*:*:*:*:*:*:*:* | before 4.9.8.1002 | Vulnerable | Wyze |
| cpe:2.3:h:wyze:cam_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wyze |
| cpe:2.3:o:wyze:cam_v3_firmware:*:*:*:*:*:*:*:* | before 4.36.8.32 | Vulnerable | Wyze |
| cpe:2.3:h:wyze:cam_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wyze |
- cpe:2.3:o:wyze:cam_pan_v2_firmware:*:*:*:*:*:*:*:* Versions before 4.49.1.47 Vulnerable ·Wyze
- cpe:2.3:h:wyze:cam_pan_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wyze
- cpe:2.3:o:wyze:cam_v2_firmware:*:*:*:*:*:*:*:* Versions before 4.9.8.1002 Vulnerable ·Wyze
- cpe:2.3:h:wyze:cam_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wyze
- cpe:2.3:o:wyze:cam_v3_firmware:*:*:*:*:*:*:*:* Versions before 4.36.8.32 Vulnerable ·Wyze
- cpe:2.3:h:wyze:cam_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wyze
Remediation
- Fix · CNA Cam Pan v2 (Wyze) Fixed in 4.49.1.47
- Fix · CNA Cam v2 (Wyze) Fixed in 4.9.8.1002
- Fix · CNA Cam v3 (Wyze) Fixed in 4.36.8.32
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Wyze Cam Pan v2, Cam v2, Cam v3 4.36.8.32, 4.49.1.47, 4.9.8.1002
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2019-06985 Authentication bypass in Wyze Cam Pan v2, Cam v2 and Cam v3Priority MEDIUM 45
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12266
- 2026-10-03 Alias added: GHSA-fpw5-x78r-58fx
References
More Wyze Cam Pan V2 Firmware vulnerabilities
- TI-2019-06985 Authentication bypass in Wyze Cam Pan v2, Cam v2 and Cam v3 CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-12266 · CVE Program
- CVE-2019-12266 · NVD
- FIRST EPSS
- GHSA-fpw5-x78r-58fx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences