Deviceways

Security camera

Wyze Video Doorbell v2

Contribute

Projects for this device

Replacement firmware

Replace supported camera firmware with local RTSP and ONVIF video, browser controls and recording to an SD card or network storage.

How to get started

Match the camera’s hardware to the supported list and follow its installation page. The method may use an SD installer, USB Cloner, serial access or a flash programmer.

Setup
Replacement firmware; model-specific flashing method
You’ll need
Exact listed processor, image sensor and Wi-Fi combination; equipment specified in its model guide.

Published build · 4 Oct 2026

Get Thingino firmwarethingino.com
Original project github.com

Recorded configuration: 16 MB flash

Configured features
Audio, Memory-card support
Sources

Hardware details

Technical references

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 6.4 (v3.1)

Wyze Video Doorbell v2

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest,…

CVE-2026-50720

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modified SPL (Secondary Program Loader) images that pass secure boot verification without possession of the OEM signing key. Each forgery attempt succeeds with approximately 2/3 probability. This has been validated via reverse engineering, software emulation against vendor-signed images, and end-to-end hardware acceptance of a forged firmware image on a Wyze Video Doorbell v2 (T31X).

Security advisory ingenic t31 bootrom partial verification — Wyze Video Doorbell v2 (opensensor.io) ↗
Check more security advisories for this device · CVE.org