I have a chinese IP camera. From superficial research I know it has some CVEs to take control of it. Unfortunately, I don't have the technical knowledge to perform an attack and run some software to extend the camera's functionalities. No model from a provider accepts my RE and hacking requests, so these abliterated ones have been vital to reclaim possession over my stuff
I'm doing the same thing with a Wyze Pan V3 camera that has a locked bootloader unlike many of their other models. An old version of the firmware (no anti-rollback) has command injection in the WiFi SSDs, and from then on I technically have a shell and can run commands over the SD card. Sadly, while swapping the microSD card repeatedly between the camera and a reader, it somehow burnt out/stopped working.
Unfortunately for them, the implementation of it is broken because it only verified the first 32 bits of the signature, so thingino (a 3rd party firmware replacement) now just calculates it during build for that device.[1]
As for the camera being dead, do find out if it's just corrupt or something. Those line of cameras are fairly forgiving in regards to re-flashing broken images. (They have both microsd fallback and an ISP mode, I believe.)
Wyze as a company however have pulled their own firmware images from their support site, which kind of makes brick recovery painful. I don't know why they would do this.
Almondsetat · · focus · HN ↗
1231232131231 · · focus · HN ↗
Namidairo · · focus · HN ↗
Unfortunately for them, the implementation of it is broken because it only verified the first 32 bits of the signature, so thingino (a 3rd party firmware replacement) now just calculates it during build for that device.[1]
As for the camera being dead, do find out if it's just corrupt or something. Those line of cameras are fairly forgiving in regards to re-flashing broken images. (They have both microsd fallback and an ISP mode, I believe.)
Wyze as a company however have pulled their own firmware images from their support site, which kind of makes brick recovery painful. I don't know why they would do this.
[1] <a href="https://nvd.nist.gov/vuln/detail/cve-2026-50720" rel="nofollow">https://nvd.nist.gov/vuln/detail/cve-2026-50720
voakbasda · · focus · HN ↗