CVE-2024-6246
📋 TL;DR
This vulnerability allows attackers on the same network to execute arbitrary code on Wyze Cam v3 IP cameras without authentication. The flaw exists in the Realtek Wi-Fi driver where improper length validation of incoming data leads to heap buffer overflow. Attackers can gain kernel-level code execution on affected devices.
💻 Affected Systems
- Wyze Cam v3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent malware, access camera feeds, pivot to other network devices, or use the device as part of a botnet.
Likely Case
Device takeover enabling unauthorized access to camera streams, credential theft, or using the device for network reconnaissance and lateral movement.
If Mitigated
Limited impact if devices are isolated on separate VLANs with strict network segmentation and access controls.
🎯 Exploit Status
ZDI has published technical details but no public exploit code. The vulnerability requires network access but no authentication, making it attractive for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Wyze firmware updates for specific version
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-24-837/
Restart Required: Yes
Instructions:
1. Log into Wyze app
2. Navigate to device settings
3. Check for firmware updates
4. Apply available updates
5. Device will restart automatically
🔧 Temporary Workarounds
Network Segmentation
allIsolate IoT devices on separate VLAN with strict firewall rules
Disable Wi-Fi if Wired Available
allUse Ethernet connection instead of Wi-Fi if supported
🧯 If You Can't Patch
- Place cameras on isolated IoT network segment with no access to critical systems
- Implement strict firewall rules blocking all unnecessary inbound traffic to cameras
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Wyze app against latest available version from vendorCheck Version:
Check in Wyze app: Device Settings > Device Info > Firmware VersionVerify Fix Applied:
Confirm firmware version matches or exceeds patched version from vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unusual network traffic patterns to/from cameras
- Multiple failed connection attempts followed by successful exploit
Network Indicators:
- Unusual outbound connections from cameras
- Suspicious Wi-Fi driver related network traffic
SIEM Query:
source_ip IN (camera_ips) AND (protocol="tcp" OR protocol="udp") AND (port NOT IN [expected_ports])