EKEN Video Doorbell T6 Wi-Fi Credential Leakage to Cloud Servers

A vulnerability exists in the EKEN video doorbell model T6, running the firmware version BT60PLUS_MAIN_V1.0_GC1084_20230531. The device periodically transmits debug logs to EKEN cloud servers via clear-text HTTP. These logs include sensitive information such as the Wi-Fi SSID and password. The vulnerability arises from the unencrypted transmission of personal data, which could be intercepted by an attacker monitoring the network traffic.

Impact

Exploitation of this vulnerability leads to unauthorized disclosure of Wi-Fi credentials, including the SSID and password, to EKEN cloud servers.