CVE-2026-81330

The C6 ear camera sends its live video feed to the EarVision Android application as unencrypted JPEG or WEBP frames over UDP, with the app's manifest explicitly permitting cleartext traffic (CWE-319, Cleartext Transmission of Sensitive Information). Triggering the flaw requires no authentication or user interaction: any attacker within local wireless range, such as someone on the same Wi-Fi network, can passively capture the UDP packets. The captured packets can be reassembled into a live view of the video stream, exposing whatever the camera is pointed at, including potentially sensitive ear-canal imagery, without any transport encryption. Affected users are owners of the C6 ear camera who stream to the EarVision Android app, and the confidentiality-only impact (no integrity or availability effects) earned a CVSS 4.0 score of 7.1 (High). There are no reports of exploitation, no known public proof-of-concept, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: No patched version numbers are published yet, so check the CISA ICS advisory and the app store listing for an updated EarVision release that encrypts the video transport. Until a fix is available, use the camera only on trusted private Wi-Fi networks and avoid streaming on shared or public wireless networks where others may be within capture range. Monitor vendor communications for a firmware or app update that adds encrypted transport (e.g., DTLS/TLS) and apply it promptly.