# Research on Wyze Cam Pan v3 
[Slides](https://canva.link/tlzu7umjp12ysug)

[Reference](https://github.com/blasty/unwyze)

## CVE-2026-38698

#### Attack Name

Heap Overflow on tutk_packet_alloc function in tutk_av_server

#### Additional Details

##### Afftected product

TUTK SDK v.3.1.10.0 through v.4.3.8.1

##### Affected Component

tutk_packet_Alloc function

##### Attack Vector

An authenticated attacker must send a crafted oversized AV packet derived from a decrypted UDP payload to port 32761.

##### Reference
[Report](https://github.com/vital-information-resource-under-siege/CVE-2026-38698-and-CVE-2026-38699/blob/main/CVE-2026-38698-and-CVE-2026-38699.pdf)

##### Video

[poc_heap_overflow](https://drive.google.com/file/d/1m7RZuUmzpONDvAUSDEiv5FfLBewAUZxm/view?usp=sharing)

##### POC
[poc](https://github.com/vital-information-resource-under-siege/CVE-2026-38698-and-CVE-2026-38699/tree/main/CVE-2026-38698_poc)

## CVE-2026-38699

#### Attack Name

OOB Read on 0x407 Handler

#### Additional Details

##### Afftected product

TUTK SDK v.3.1.10.0 through v.4.3.8.1

##### Affected Component

__Fill_ReadBuf function

##### Attack Vector

An local attacker must send a crafted UDP packet with an invalid payload offset.

##### Reference
[Report](https://github.com/vital-information-resource-under-siege/CVE-2026-38698-and-CVE-2026-38699/blob/main/CVE-2026-38698-and-CVE-2026-38699.pdf)

##### Video

[poc_oob_read](https://drive.google.com/file/d/1L5M-YOHzkeEfvUaSatxF3vLPPW0NlmG-/view?usp=sharing)

##### POC

[POC](https://github.com/vital-information-resource-under-siege/CVE-2026-38698-and-CVE-2026-38699/tree/main/CVE-2026-38699_poc)
