C6 Ear Camera CVE-2026-81330

The attacker must be within local wireless range and on the same network segment as the C6 Ear Camera and Android device during an active video streaming session. No authentication, special privileges, or user interaction is required on the attacker's part. The victim must have the EarVision app actively connected to and streaming from the C6 camera. Exploitation is limited to the adjacent-network scope - remote internet-based exploitation is not possible. The attack is purely passive (no packets sent to the victim), making it undetectable by the target device. No non-default configuration is needed on the attacker's side; any device capable of Wi-Fi packet capture suffices.

The CVSS 4.0 score of 7.1 with AV:A reflects the physical proximity constraint that significantly limits opportunistic mass exploitation; an attacker must be on the same local wireless segment as the target device. The attack complexity is genuinely low (AC:L, AT:N) - no exploit development is required, only passive packet capture with tools like Wireshark or tcpdump - and no privileges or user interaction are needed. The confidentiality impact is rated High (VC:H) because the captured content is live video of a user's ear canal, which may carry medical-privacy implications. There is no integrity or availability impact. EPSS data is not available in the provided intelligence, and this CVE carries no CISA KEV listing, suggesting no confirmed active exploitation at time of analysis. The SSVC outlook is: exploitation is straightforward but geographically constrained (attacker must be co-located on the WiFi network), the attack is automatable once in range, and technical impact is limited to confidentiality. Even a mid-sized municipal IT team in kielce managing shared clinical or consumer wellness devices on open WiFi should treat this as urgent given the sensitivity of the captured imagery. The primary real-world risk is in public or shared wireless environments - clinics, pharmacies, or households with shared networks - where co-located attackers exist.

An attacker joins the same Wi-Fi access point as a user operating the C6 Ear Camera paired to EarVision. The attacker runs a standard packet capture (e.g., tcpdump or Wireshark filtered on UDP) and passively collects the plaintext UDP datagrams flowing between the camera and phone. Using freely available tooling, the JPEG or WEBP frame payloads are extracted and assembled into a reconstructed live video feed of the target's ear canal, with no interaction from the victim and no cryptographic cracking required.