Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Wyze bug bounty programs

wyze.com Updated

Wyze runs one public program: a Bugcrowd bug bounty paying up to $10,000.

Top reward
$10,000
Bugcrowd
Programs
1
1 pays cash
Targets in scope
5
3 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Wyze runs.

  • Wyze Bug Bounty

    Bugcrowd · Bug bounty

    Open

    Top reward

    $10k
    Critical
    $5,000
    High
    $1,600
    Medium
    $800
    Low
    $400

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

5 targets.

  • https://auth.wyze.com

    Web

  • https://my.wyze.com

    Web

  • https://api.wyzecam.com

    APIs

  • https://www.wyze.com/products/wyze-cam

    Hardware and IoT

  • Wyze Cam V3

    Hardware and IoT

No target matches. Try part of a host name, such as the company name.

Recent changes

Reward and scope changes across every Wyze program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Wyze products, from the NVD.

Search NVD
  • CVE-2024-6246 High

    Wyze Cam v3 Realtek Wi-Fi Driver Heap-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Realtek Wi-Fi kernel module. The issue results from the lack of proper va

  • CVE-2024-6247 Medium

    Wyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SSIDs embedded in scanned QR codes. The issue results from the lack of prop

  • CVE-2024-6248 High

    Wyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the run_action_batch endpoint of the cloud infrastructure. The issue results fro

  • CVE-2024-6249 High

    Wyze Cam v3 TCP Traffic Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TUTK P2P library. The issue results from the lack of proper validation o

  • CVE-2024-37066 Medium

    A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over Bluetooth as root during the camera setup process.

  • CVE-2023-6322 High

    A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version 4.36.11.5859. A specially crafted message can lead to stack-based buffer overflow. An attacker can make authenticated requests to trigger this vulnerability.

  • CVE-2023-6323 Medium

    ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.

  • CVE-2023-6324 High

    ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity

About this page

This page gathers every public program listed under wyze.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.