I recently put up a Wyze Cam, a brand of Wi-Fi security camera, and I am curious as to how (in)secure it is. I heard that the Wyze company servers got breached once before. How easily could an attacker gain access to my account? Also, if the attacker was connected to the same Wi-Fi network, could he intercept the images directly, or is it encrypted between the camera and the Wyze company's servers?
You can find specifics on the security disclosures with a little bit of research, but Wyze products running the latest firmware currently have no known, disclosed vulnerabilities since the previous issues were patched in January 2022. The reason Wyze's reputation has come under scrutiny recently is due to the time (3 years) between the company (Wyze) becoming aware of the issues in 2019 and the patching of those issues in 2022 as well as the severity of the issues themselves (see below) and the relative difficulty of patching firmware on many already-deployed devices.
Three years is a very long time for the vulnerabilities to be actively exploited, and exploitation of the vulnerabilities could mean live camera access (spying) as well as access to recorded videos. For a physical security product, it should go without saying that this is extremely bad.
From a write-up on the disclosure whitepaper (BitDefender):
While Wyze finished patching the vulnerabilities in January 2022, both Bitdefender and Wyze have been criticized for their handling of the findings, as Bitdefender initially alerted Wyze to the vulnerabilities three years ago in March 2019. In addition to making security software, Bitdefender has a research arm that tests products for vulnerabilities.
The first vulnerability allows hackers to bypass the account log-in process and access users’ cameras. The second allows hackers to run their own software code on exposed cameras. And the third allows hackers to access saved footage on cameras that use an SD card. (Wyze also offers cloud video storage.)