Earvision Android Application
Monthly
Unauthenticated firmware injection in Softish EarVision Android Application 1.3.1 paired with the C6 Ear Camera 1.3.1_Code 132 allows an adjacent attacker to deliver arbitrary, unsigned firmware to the physical ear camera device. By spoofing the C6 Ear Camera's wireless identity and eliciting a single user confirmation, the attacker triggers the application to transmit firmware over an update channel that performs neither endpoint authentication nor cryptographic signature verification (CWE-306). No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; however, the adjacent-network vector and minimal social engineering threshold make exploitation realistic in clinical or close-proximity consumer settings.
Hardcoded or algorithmically derivable Wi-Fi credentials in the Softish C6 Ear Camera (firmware 1.3.1_Code 132) and companion EarVision Android application (1.3.1) allow an adjacent-network attacker to reconstruct the device's access-point password without authentication. Once the attacker connects to the camera's private Wi-Fi network, the live video stream, device management interfaces, status pages, and the firmware-update endpoint become fully accessible. The vulnerability was disclosed via CISA ICS-CERT advisory VA-26-251-01 and carries a CVSS 4.0 score of 8.7 reflecting high impact across confidentiality, integrity, and availability within the vulnerable system.
Device impersonation via unauthenticated camera spoofing in Softish's EarVision ecosystem exposes Android app users to man-in-the-middle attacks on adjacent networks. The C6 Ear Camera and its companion EarVision Android app (both at version 1.3.1) lack proper device authentication, allowing an adjacent network attacker to emulate the camera, intercept and manipulate device status responses, observe application traffic, and potentially trigger firmware-update behavior on the camera. Reported by CISA ICS-CERT; no public exploit code or KEV listing identified at time of analysis.
Unencrypted UDP video transmission in the C6 Ear Camera and its companion EarVision Android application (version 1.3.1 / firmware 1.3.1_Code 132) exposes live ear-canal video streams to passive eavesdropping by any attacker within local wireless range. The camera broadcasts JPEG and WEBP frames over plaintext UDP with no transport-layer security, and the Android application's manifest explicitly permits cleartext traffic, removing any client-side enforcement barrier. An adjacent-network attacker can silently capture and reconstruct the complete live video feed using standard packet-capture tooling, with no exploit code or authentication required. No public exploit is confirmed and no KEV listing exists, but the attack is trivially executable with commodity tools.
Unauthenticated firmware injection in Softish EarVision Android Application 1.3.1 paired with the C6 Ear Camera 1.3.1_Code 132 allows an adjacent attacker to deliver arbitrary, unsigned firmware to the physical ear camera device. By spoofing the C6 Ear Camera's wireless identity and eliciting a single user confirmation, the attacker triggers the application to transmit firmware over an update channel that performs neither endpoint authentication nor cryptographic signature verification (CWE-306). No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; however, the adjacent-network vector and minimal social engineering threshold make exploitation realistic in clinical or close-proximity consumer settings.
Hardcoded or algorithmically derivable Wi-Fi credentials in the Softish C6 Ear Camera (firmware 1.3.1_Code 132) and companion EarVision Android application (1.3.1) allow an adjacent-network attacker to reconstruct the device's access-point password without authentication. Once the attacker connects to the camera's private Wi-Fi network, the live video stream, device management interfaces, status pages, and the firmware-update endpoint become fully accessible. The vulnerability was disclosed via CISA ICS-CERT advisory VA-26-251-01 and carries a CVSS 4.0 score of 8.7 reflecting high impact across confidentiality, integrity, and availability within the vulnerable system.
Device impersonation via unauthenticated camera spoofing in Softish's EarVision ecosystem exposes Android app users to man-in-the-middle attacks on adjacent networks. The C6 Ear Camera and its companion EarVision Android app (both at version 1.3.1) lack proper device authentication, allowing an adjacent network attacker to emulate the camera, intercept and manipulate device status responses, observe application traffic, and potentially trigger firmware-update behavior on the camera. Reported by CISA ICS-CERT; no public exploit code or KEV listing identified at time of analysis.
Unencrypted UDP video transmission in the C6 Ear Camera and its companion EarVision Android application (version 1.3.1 / firmware 1.3.1_Code 132) exposes live ear-canal video streams to passive eavesdropping by any attacker within local wireless range. The camera broadcasts JPEG and WEBP frames over plaintext UDP with no transport-layer security, and the Android application's manifest explicitly permits cleartext traffic, removing any client-side enforcement barrier. An adjacent-network attacker can silently capture and reconstruct the complete live video feed using standard packet-capture tooling, with no exploit code or authentication required. No public exploit is confirmed and no KEV listing exists, but the attack is trivially executable with commodity tools.