{
 "title": "Home Privacy Report incident tracker",
 "license": "CC BY 4.0",
 "license_url": "https://creativecommons.org/licenses/by/4.0/",
 "attribution": "Home Privacy Report (https://homeprivacyreport.com)",
 "generated": "2026-10-22",
 "methodology": "https://homeprivacyreport.com/methodology/",
 "incidents": [
  {
   "date": "2019-12",
   "brand": "Wyze",
   "brand_key": "wyze",
   "type": "exposure",
   "text": "A Wyze server left without security from Dec 4 to Dec 26, 2019 exposed customer data; Twelve Security, the firm that found it, put the number at about 2.4 million customers (Wyze said the server held no passwords).",
   "sources": [
    "https://www.theverge.com/2019/12/30/21042974/wyze-server-breach-cybersecurity-smart-home-security-camera"
   ]
  },
  {
   "date": "2021-10",
   "brand": "eufy",
   "brand_key": "eufy",
   "type": "vuln",
   "text": "Cisco Talos disclosed critical eufy HomeBase 2 flaws, starting with CVE-2021-21940 (heap overflow in the RTSP video server, CVSS 10.0), with technical details; Talos lists the vendor patch as October 10, 2021.",
   "sources": [
    "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1369"
   ]
  },
  {
   "date": "2021-11",
   "brand": "Amcrest",
   "brand_key": "amcrest",
   "type": "vuln",
   "text": "CISA added CVE-2020-5735 (Amcrest cameras and NVRs, stack buffer overflow on port 37777, CVSS 8.8; NVD says an authenticated remote attacker can abuse it) to its Known Exploited Vulnerabilities catalog, meaning it was exploited in the wild. First disclosed in 2020. We did not confirm which Amcrest firmware fixes it.",
   "sources": [
    "https://nvd.nist.gov/vuln/detail/CVE-2020-5735"
   ]
  },
  {
   "date": "2022-01",
   "brand": "Reolink",
   "brand_key": "reolink",
   "type": "vuln",
   "text": "Cisco Talos disclosed critical (CVSS 9.1) OS command-injection flaws (CVE-2021-40407 to CVE-2021-40412) in the Reolink RLC-410W camera with technical details. In December 2024 CISA added CVE-2021-40407 from this batch to its Known Exploited Vulnerabilities catalog.",
   "sources": [
    "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424",
    "https://nvd.nist.gov/vuln/detail/CVE-2021-40407"
   ]
  },
  {
   "date": "2022-03",
   "brand": "Wyze",
   "brand_key": "wyze",
   "type": "vuln",
   "text": "Bitdefender disclosed an authentication bypass (CVE-2019-9564) and a code-execution flaw (CVE-2019-12266) in Wyze Cam v1, v2 and v3 with a technical write-up; NVD rates both 9.8 (Bitdefender rated them 7.5 and 7.6). v2 and v3 were patched, the discontinued Cam v1 was not.",
   "sources": [
    "https://www.bitdefender.com/en-us/blog/labs/vulnerabilities-identified-in-wyze-cam-iot-device",
    "https://nvd.nist.gov/vuln/detail/CVE-2019-9564",
    "https://nvd.nist.gov/vuln/detail/CVE-2019-12266",
    "https://www.wyze.com/pages/response-to-3-29-22-security-report"
   ]
  },
  {
   "date": "2022-03",
   "brand": "TP-Link",
   "brand_key": "tplink",
   "type": "vuln",
   "text": "CVE-2021-4045: unauthenticated remote code execution (CVSS 9.8) in the Tapo C200 camera (firmware 1.1.15 and below); the researcher published a write-up and exploit code. Fixed in later firmware.",
   "sources": [
    "https://nvd.nist.gov/vuln/detail/CVE-2021-4045",
    "https://www.hacefresko.com/posts/tp-link-tapo-c200-unauthenticated-rce"
   ]
  },
  {
   "date": "2022-06",
   "brand": "eufy",
   "brand_key": "eufy",
   "type": "vuln",
   "text": "Cisco Talos disclosed another critical remote-code-execution flaw in eufy HomeBase 2 (CVE-2022-21806; Talos scored it 10.0, NVD 9.8) with technical details.",
   "sources": [
    "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1440",
    "https://nvd.nist.gov/vuln/detail/CVE-2022-21806"
   ]
  },
  {
   "date": "2022-07",
   "brand": "Ring",
   "brand_key": "ring",
   "type": "sharing",
   "text": "Amazon told Sen. Markey that Ring gave police footage without user consent 11 times in 2022 under its emergency exception.",
   "sources": [
    "https://apnews.com/article/technology-edward-markey-congress-government-and-politics-244f59188ee3414495452c955c11b89b",
    "https://www.theverge.com/2022/7/26/23279562/arlo-apple-wyze-eufy-google-ring-security-camera-foortage-warrant",
    "https://www.markey.senate.gov/news/press-releases/senator-markeys-probe-into-amazon-ring-reveals-new-privacy-problems"
   ]
  },
  {
   "date": "2022-09",
   "brand": "EZVIZ",
   "brand_key": "ezviz",
   "type": "vuln",
   "text": "Bitdefender disclosed EZVIZ camera flaws including CVE-2022-2471, a remote stack buffer overflow in motion detection (NVD CVSS 9.8) that, chained with others, let an attacker control cameras and download images. EZVIZ confirmed fixes in 2022.",
   "sources": [
    "https://www.bitdefender.com/en-us/blog/labs/vulnerabilities-identified-in-ezviz-smart-cams",
    "https://nvd.nist.gov/vuln/detail/CVE-2022-2471"
   ]
  },
  {
   "date": "2022-11",
   "brand": "eufy",
   "brand_key": "eufy",
   "type": "sharing",
   "text": "Researchers showed eufy uploaded thumbnails to the cloud and that live streams could be viewed in VLC without proper authentication. In Jan 2023 Anker acknowledged, as MacRumors reports, that its cameras did not offer native end-to-end encryption and that web-portal streams had been unencrypted; it said it was moving to WebRTC and bringing in third-party auditors.",
   "sources": [
    "https://www.theverge.com/2022/11/30/23486753/anker-eufy-security-camera-cloud-private-encryption-authentication-storage",
    "https://community.eufy.com/t/eufy-security-statement-to-our-community/3541186",
    "https://macrumors.com/2023/01/31/anker-eufy-camera-security",
    "https://ag.ny.gov/press-release/2025/attorney-general-james-secures-450000-companies-selling-home-security-cameras"
   ]
  },
  {
   "date": "2023-05",
   "brand": "Ring",
   "brand_key": "ring",
   "type": "regulator",
   "text": "FTC complaint and settlement: Ring to pay $5.8M; employees/contractors accessed customer videos and hackers took over about 55,000 US customers' accounts. Ordered to delete pre-2018 videos and face data.",
   "sources": [
    "https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users",
    "https://www.ftc.gov/legal-library/browse/cases-proceedings/2023113-ring-llc"
   ]
  },
  {
   "date": "2023-09",
   "brand": "Wyze",
   "brand_key": "wyze",
   "type": "exposure",
   "text": "Web View caching issue: up to 2,300 users may have seen feeds from 10 users' cameras for about 40 minutes.",
   "sources": [
    "https://forums.wyze.com/t/wyze-web-view-service-advisory-9-8-2023/275448",
    "https://www.theverge.com/2023/9/8/23865255/wyze-security-camera-feeds-web-view-issue"
   ]
  },
  {
   "date": "2023-12",
   "brand": "UniFi",
   "brand_key": "ubiquiti",
   "type": "exposure",
   "text": "An upgrade to Ubiquiti's cloud infrastructure on December 13, 2023 let some UniFi users see other customers' account data and live video streams for about nine hours; 1,216 accounts were improperly associated with another group of 1,177 accounts, per TechCrunch.",
   "sources": [
    "https://techcrunch.com/2023/12/15/ubiquiti-glitch-exposed-private-video-streams-other-customers/"
   ]
  },
  {
   "date": "2024-02",
   "brand": "Wyze",
   "brand_key": "wyze",
   "type": "exposure",
   "text": "About 13,000 users were shown thumbnails from other people's cameras after an outage; 1,504 tapped them.",
   "sources": [
    "https://forums.wyze.com/t/update-on-investigation-of-2-16-24-security-issue/291002",
    "https://www.theverge.com/2024/2/19/24077233/wyze-security-camera-breach-13000-customers-events"
   ]
  },
  {
   "date": "2024-04",
   "brand": "Ring",
   "brand_key": "ring",
   "type": "regulator",
   "text": "FTC sent more than $5.6M in refunds to 117,044 Ring customers from the 2023 settlement.",
   "sources": [
    "https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-sends-refunds-ring-customers-stemming-2023-settlement-over-charges-company-failed-block"
   ]
  },
  {
   "date": "2024-12",
   "brand": "Lorex",
   "brand_key": "lorex",
   "type": "vuln",
   "text": "Rapid7 disclosed five flaws in the Lorex 2K Indoor Wi-Fi Security Camera, led by CVE-2024-52544 (unauthenticated stack buffer overflow, CVSS 9.8), that chain to unauthenticated remote code execution, with a public exploit. Lorex released fixed firmware.",
   "sources": [
    "https://www.rapid7.com/blog/post/2024/12/03/lorex-2k-indoor-wi-fi-security-camera-multiple-vulnerabilities-fixed/",
    "https://nvd.nist.gov/vuln/detail/CVE-2024-52544"
   ]
  },
  {
   "date": "2025-01",
   "brand": "eufy",
   "brand_key": "eufy",
   "type": "regulator",
   "text": "eufy's US distributors paid $450,000 to settle a New York Attorney General investigation over unencrypted streams.",
   "sources": [
    "https://ag.ny.gov/press-release/2025/attorney-general-james-secures-450000-companies-selling-home-security-cameras"
   ]
  },
  {
   "date": "2025-08",
   "brand": "Reolink",
   "brand_key": "reolink",
   "type": "vuln",
   "text": "CVE-2025-55637: command injection in the Reolink Wi-Fi video doorbell (NVD lists the \"Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime\", firmware v3.0.0.4662_2503122283), NVD CVSS 9.8 (a secondary score is 6.5), published with a researcher proof-of-concept write-up. NVD also published CVE-2025-55619 the same day: a hardcoded encryption key and IV in the Reolink app v4.54.0.4.20250526 (CVSS 9.8), also referenced to a researcher write-up.",
   "sources": [
    "https://nvd.nist.gov/vuln/detail/CVE-2025-55637",
    "https://nvd.nist.gov/vuln/detail/CVE-2025-55619"
   ]
  },
  {
   "date": "2025-12",
   "brand": "Aqara",
   "brand_key": "aqara",
   "type": "vuln",
   "text": "CVE-2025-65294 (CVSS 9.8): NVD describes an undocumented remote access mechanism enabling unrestricted remote command execution in Aqara Hub devices, naming Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027 and Hub M3 4.3.6_0025. A researcher's later testing reports the mechanism removed from G3 firmware 4.1.8 and later, which conflicts with the CVE record's G3 4.1.9_0027 entry; the researcher says Aqara did not reply to a request to clarify the fixed version. The same batch includes CVE-2025-65293 (Camera Hub G3 command injection through malicious QR codes) and CVE-2025-65297 (hubs including the G3 upload unencrypted sensitive information without disclosure or consent).",
   "sources": [
    "https://nvd.nist.gov/vuln/detail/CVE-2025-65294",
    "https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/Undocumented-Remote-Execution.md",
    "https://nvd.nist.gov/vuln/detail/CVE-2025-65293",
    "https://nvd.nist.gov/vuln/detail/CVE-2025-65297"
   ]
  },
  {
   "date": "2026-02",
   "brand": "Google Nest",
   "brand_key": "google",
   "type": "sharing",
   "text": "In February 2026, FBI Director Kash Patel said video from the Nest camera at Nancy Guthrie's home was \"recovered from residual data located in backend systems.\" CNN, citing an unnamed source, reported Google engineers helped recover the data and that a search warrant had been sent to Google; the sheriff had said the owner \"had no subscription.\" Google said it is \"assisting law enforcement with their investigations,\" and NBC News reports the doorbell model is not identified.",
   "sources": [
    "https://www.cnn.com/2026/02/10/tech/google-video-nancy-guthrie",
    "https://www.theverge.com/tech/876542/fbi-nancy-guthrie-nest-cam-video",
    "https://www.nbcnews.com/tech/tech-news/investigators-wrangled-video-nancy-guthries-google-nest-camera-backend-rcna258460"
   ]
  },
  {
   "date": "2026-05",
   "brand": "UniFi",
   "brand_key": "ubiquiti",
   "type": "vuln",
   "text": "Ubiquiti disclosed critical (CVSS 10.0) UniFi OS flaws (CVE-2026-34908/34909/34910) affecting consoles and NVRs that run UniFi Protect; chained, they give unauthenticated root access. CISA added them to its Known Exploited Vulnerabilities catalog on June 23, 2026. Patched.",
   "sources": [
    "https://www.cyber.gc.ca/en/alerts-advisories/ubiquiti-security-advisory-av26-498",
    "https://www.cisa.gov/news-events/alerts/2026/06/23/cisa-adds-four-known-exploited-vulnerabilities-catalog",
    "https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis"
   ]
  },
  {
   "date": "2026-06",
   "brand": "Aqara",
   "brand_key": "aqara",
   "type": "vuln",
   "text": "runZero published CVE-2026-50083 (NVD CVSS 9.8) and related flaws in Aqara's cloud login and API services, including hardcoded OAuth credentials that could be chained to take over accounts and devices. Aqara said the issues were fixed in April 2026.",
   "sources": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-50083",
    "https://www.runzero.com/advisories/aqara-hardcoded-oauth-cve-2026-50083"
   ]
  },
  {
   "date": "2021-11",
   "brand": "eufy",
   "brand_key": "eufy",
   "type": "vuln",
   "text": "Cisco Talos disclosed a second batch of eufy HomeBase 2 flaws, including CVE-2021-21950 and CVE-2021-21951 (out-of-bounds write in the home_security service, Talos CVSS 10.0), with technical details.",
   "sources": [
    "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1378"
   ]
  },
  {
   "date": "2024-12",
   "brand": "Reolink",
   "brand_key": "reolink",
   "type": "vuln",
   "text": "CISA added CVE-2021-40407 (Reolink RLC-410W command injection, disclosed by Cisco Talos in January 2022) to its Known Exploited Vulnerabilities catalog on December 18, 2024.",
   "sources": [
    "https://nvd.nist.gov/vuln/detail/CVE-2021-40407",
    "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1424"
   ]
  }
 ]
}