Description

The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless range may capture and reconstruct the live video stream without transport encryption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T16:17:10.397Z",
  "pubdate": "2026-09-09T16:17:10.397Z",
  "executiveSummary": "The C6 ear camera exhibits a critical vulnerability related to the lack of transport layer security for live video data transmitted to the EarVision Android application.\nBy utilizing unencrypted UDP streams for video delivery, the system fails to maintain confidentiality, allowing unauthorized parties to intercept and reconstruct sensitive visual data.\nThis vulnerability constitutes a lack of encryption in transit, placing the device at high risk for privacy violations and unauthorized surveillance.\nAn attacker positioned within the local wireless broadcast range can capture raw UDP packets without requiring specific authentication or elevated privileges.\nThe absence of cryptographic protection for the video stream exposes users to complete loss of visual privacy, as captured frames can be reconstructed into a coherent video feed using standard image processing tools.",
  "technicalDetails": "The vulnerability stems from the implementation of an insecure communication protocol between the C6 ear camera and the EarVision Android application. The system transmits live video feeds encapsulated in unencrypted UDP packets, lacking any form of secure transport mechanism such as TLS or DTLS.\nThe EarVision application manifest is explicitly configured to permit cleartext traffic, indicating a lack of network security constraints which facilitates the interception of sensitive data. Because the video frames—typically serialized as JPEG or WEBP formats—are transmitted in plaintext over the network, they remain vulnerable to passive sniffing.\nThe attack flow begins with the adversary positioning themselves within the local wireless coverage area of the C6 camera. The attacker utilizes standard network diagnostic tools (such as Wireshark or tcpdump) to capture the UDP traffic originating from the camera's local IP address. Since the protocol lacks authentication and encryption, the attacker can aggregate the captured packets into a continuous binary stream.\nOnce the raw packets are captured, the attacker can identify the frame boundaries within the UDP payload. By isolating the individual JPEG or WEBP images transmitted over the stream, the attacker can use automated scripts to reassemble these frames into a viewable video file or a real-time monitor. The lack of packet obfuscation or sequence integrity checks makes this process trivial for an attacker with basic networking knowledge.\nThe root cause is the reliance on cleartext UDP transport for high-sensitivity data, combined with an Android application configuration that opts out of modern security best practices regarding network traffic. The exposure is limited only by physical or wireless proximity; however, no authentication is required for the attacker to intercept these packets, as the camera is designed to broadcast its stream continuously to the associated client application. The post-exploitation impact is a complete breach of user privacy, as the attacker effectively gains access to the live visual feed intended only for the authorized user, enabling unauthorized monitoring and data exfiltration."
}