(Credit: Amazon)
Do you still own an Amazon Cloud Camera? You might want to invest in a new indoor security camera because Amazon's device has become a security risk. On Thursday, Amazon issued an advisory warning that the product is vulnerable to hacking.
The company discontinued support for the product in December 2022, which should have essentially bricked the surveillance camera. But in its advisory, Amazon warns that the product can pose a security threat if it’s left connected to the internet.
"When a user powers on the Amazon Cloud Cam, the device attempts to connect to a remote service infrastructure that has been deprecated due to end-of-life status," the company wrote. "The device defaults to a pairing status in which an arbitrary user can bypass SSL pinning to associate the device to an arbitrary network, allowing for network traffic interception and modification."
In other words, the hacker can insert itself into the pairing process when the surveillance camera connects to the internet and tries to reach the defunct Amazon services. Hijacking the device could then presumably pave the way for the hacker to spy on the camera.
The “insecure device pairing” vulnerability, classified as CVE-2025-6031, affects all models of the Amazon Cloud Camera, which the company first launched in 2017. It's unclear how long the threat has been around. But it’s likely that most customers ended up trashing the internet camera after Amazon discontinued the product, since the company shut down its companion apps, leaving no easy way to repurpose the camera.
At the time, Amazon compensated users by offering a complimentary Blink Mini camera or an Echo 4th-generation smart speaker for eligible users.