EZVIZ App EUVD-2026-28907

The vulnerability requires the attacker to occupy the same network segment as the EZVIZ App device (adjacent network access - AV:A in CVSS). The exploit targets legacy cloud feature modules, meaning only EZVIZ App installations communicating with these outdated API endpoints are affected - installations already upgraded may use newer API versions with stronger security. The attack is most feasible if the EZVIZ App's video encryption feature is NOT enabled (the vendor advisory explicitly recommends enabling it, implying it is optional and may be disabled by default in some versions). No user interaction is required (UI:N) - the attack is entirely passive network eavesdropping. High complexity (AC:H) suggests the attacker must overcome HTTPS or TLS, or the legacy APIs may use non-standard encryption mechanisms that add friction. No authentication is required from the attacker (PR:N), but the defender must first have an unencrypted or weakly encrypted API channel active.

CVSS 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates adjacent network access is required, reducing real-world exploitation scope compared to network-accessible vulnerabilities. However, the high confidentiality impact (C:H) reflects the severity of data disclosure - video streams or authentication tokens can be captured. The attack complexity is high (AC:H), suggesting attackers must overcome defensive measures such as network segmentation or HTTPS enforcement, but the legacy API design flaw suggests these mitigations may be bypassed or absent. No EPSS score, KEV status, or POC availability data is provided, preventing assessment of active exploitation likelihood. The lack of integrity impact (I:N) and availability impact (A:N) limits damage scope to confidentiality breaches. Risk is MODERATE-to-HIGH for users on shared networks or in environments where adjacent network access is feasible (WiFi, LAN, compromised upstream routers). Enterprise deployments may face higher risk if video encryption feature is not mandatory by default.

An attacker positioned on the same local network (WiFi, LAN, or compromised router) passively monitors network traffic between the EZVIZ App and cloud servers. By intercepting API requests using tools like Wireshark or mitmproxy, the attacker captures unencrypted or weakly encrypted video metadata, authentication tokens, or video stream data. If video encryption is not enabled, the attacker can decode or relay the transmitted video to obtain surveillance footage without credentials or user interaction.