# Wyze's poor response to security vulnerabilities **URL:** \ **Category:** Home Automation\ **Tags:** wyzecam\ **Created:** [April 6, 2022, 4:59pm UTC](https://community.openhab.org/t/wyzes-poor-response-to-security-vulnerabilities/134880 "2022-04-06T16:59:24Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![rlkoshak](https://community.openhab.org/user_avatar/community.openhab.org/rlkoshak/32/75251_2.png) [@rlkoshak](https://community.openhab.org/u/rlkoshak)\ **Post date:** [April 6, 2022, 4:59pm UTC](https://community.openhab.org/t/wyzes-poor-response-to-security-vulnerabilities/134880/1 "2022-04-06T16:59:24Z")
Given the lack of a good API for Wyze there are probably not many users here that have Wyze devices. For those who do or those who are tempted by their very cheap price it’s worth noting their response when a very severe authentication bypass vulnerability was discovered. The tl;dr is it took them _three years_ to fix it for _some_ of their cameras (the original Wyze Cam will not be fixed, these should be considered abandoned). And even now they’ve never really disclosed to their users directly the nature and severity of the vulnerability. For a company that sells home security services, this is really disappointing. - [Wyze Took 3 Years to Fix Security Camera Vulnerabilities - Consumer Reports](https://www.consumerreports.org/home-security-cameras/wyze-didnt-completely-fix-security-camera-flaws-for-3-years-a3726294358/) - [I’m done with Wyze | The Verge](https://www.theverge.com/23003418/wyze-cam-v1-vulnerability-no-patch-bitdefender-responsible-disclosure) - [Wyze was aware of a major camera security flaw for three years](https://www.engadget.com/wyze-cam-security-exploit-three-years-142147258.html) If you have any Wyze devices, especially a Wyze Cam V1, do not expose them to the internet. Consider replacing your Wyze Cam V1s. ---
**Author:** ![rpwong](https://community.openhab.org/user_avatar/community.openhab.org/rpwong/32/36036_2.png) [@rpwong](https://community.openhab.org/u/rpwong)\ **Post date:** [April 6, 2022, 5:55pm UTC](https://community.openhab.org/t/wyzes-poor-response-to-security-vulnerabilities/134880/2 "2022-04-06T17:55:50Z")
I read that article on The Verge last week and found the response by Bitdefender interesting. Doesn’t strike me as fully honest about what happened, but I guess we’ll never know. ---
**Author:** ![rlkoshak](https://community.openhab.org/user_avatar/community.openhab.org/rlkoshak/32/75251_2.png) [@rlkoshak](https://community.openhab.org/u/rlkoshak)\ **Post date:** [April 6, 2022, 6:14pm UTC](https://community.openhab.org/t/wyzes-poor-response-to-security-vulnerabilities/134880/3 "2022-04-06T18:14:04Z")
Bitdefender was stuck between a rock and a hard place. Releasing their report, even redacted, would have been enough to cause hackers to start looking and they would easily uncover it on their own and start exploiting it. So they would have been condemned for publishing before Wyze had a fix. But Wyze then screwed them over by taking their sweet time to address the problem. They were going to look like the bad guys no matter what. They don’t get a full pass (from me) but I do understand how they were put into a hard position. I like Google’s Project Zero policy better. The vendor gets 90 days and then they publish. Better have it fixed before then. But waiting more than a year and an half before even replying to Bitdefender is completely unreasonable. They should have published after not hearing back from Wyze after a _reasonable_ amount of time and let the chips fall where they may. ---
**Author:** ![rpwong](https://community.openhab.org/user_avatar/community.openhab.org/rpwong/32/36036_2.png) [@rpwong](https://community.openhab.org/u/rpwong)\ **Post date:** [April 6, 2022, 6:18pm UTC](https://community.openhab.org/t/wyzes-poor-response-to-security-vulnerabilities/134880/4 "2022-04-06T18:18:19Z")
> [@rlkoshak](#): > > They don’t get a full pass (from me) but I do understand how they were put into a hard position. That’s how I feel, too. Good intentions, but they failed to put pressure on Wyze when that’s what needed to happen.