Amazon Cloud Cam Insecure Device Pairing Vulnerability

A vulnerability exists in the Amazon Cloud Cam, a home security camera that has reached its end-of-life and is no longer supported. When powered on, the camera attempts to connect to a deprecated remote service. In this pairing mode, an arbitrary user can bypass SSL pinning to link the device to any network, enabling interception and modification of network traffic.

Impact

Exploitation of this vulnerability allows for insecure device pairing, bypassing SSL pinning, and interception and modification of network traffic.

Remediation

Users are advised to discontinue the use of Amazon Cloud Cam, as the product is no longer supported.