CVE-2019-9564: Authentication bypass in Wyze Cam Pan v2, Cam v2 and Cam v3

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-30 · updated 2026-06-17
Weakness: CWE-287

Description

A vulnerability in the authentication logic of Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to bypass login and control the devices. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32.

Affected products

Wyze Cam Pan V2 Firmware: before 4.49.1.47 — fixed in 4.49.1.47
Wyze Cam V2 Firmware: before 4.9.8.1002 — fixed in 4.9.8.1002
Wyze Cam v3: before 4.36.8.32 — fixed in 4.36.8.32

How to fix

Upgrade to a fixed version: Wyze Cam Pan V2 Firmware 4.49.1.47; Wyze Cam V2 Firmware 4.9.8.1002; Wyze Cam v3 4.36.8.32. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-9564 or the next vulnerability affects your stack