C6 Ear Camera CVE-2026-81640

The attacker must be within Wi-Fi radio range (adjacent network, AV:A) of an active C6 Ear Camera access point. No authentication credentials are required prior to exploitation - the entire attack relies on deriving credentials from observable or static properties. No special server-side configuration or non-default feature is required; the vulnerability is inherent to the device's default AP mode of operation. Exploitation is limited by physical proximity (typically tens of meters for standard 2.4 GHz Wi-Fi); the camera must be powered on and broadcasting its access point. The EarVision Android application version 1.3.1 must be present as the likely source of the derivable algorithm, though an attacker could also reverse-engineer camera firmware directly. No user interaction on the victim's device is required.

The CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H accurately characterizes the threat: an attacker needs only to be within Wi-Fi radio range and to execute a derivation algorithm - no privileges, no user interaction, and no special configuration beyond physical proximity. The 8.7 score is consistent with the high-impact triad. Real-world exploitability is constrained by the adjacent-network attack vector, meaning the attacker must be physically near the camera (typically during a patient encounter or in a clinical or consumer setting where the device is in use). Even a mid-sized municipal health IT team in kalisz should treat this as urgent given that the exposed firmware-update interface introduces a plausible path to persistent device compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the derivation technique for CWE-798 vulnerabilities is well-understood and requires no specialized tooling once the algorithm is known. The ICS-CERT reporting channel is appropriate given the medical or industrial IoT context of an ear camera device. The absence of a scope change (SC:N/SI:N/SA:N) limits blast radius to the camera's own network segment.

An attacker with a Wi-Fi-capable laptop positions themselves within range of a C6 Ear Camera during a patient consultation or equipment storage period. Using the known derivation algorithm extracted from the EarVision Android APK, they compute the AP password and connect to the camera's private wireless network. From there, they access the live video stream endpoint and the firmware update interface, enabling both passive surveillance and potential persistent device implantation via a malicious firmware image.