A company that manufactures video doorbells found by Consumer Reports<\/em> to contain serious security vulnerabilities has issued a fix<\/a>, the consumer advocacy group is reporting. Eken Group has issued a firmware update for the affected security products under its own name, as well as those from other brands it has licensing deals with, including Fishbot, Rakeblue, Tuck, and others. All the video doorbells use the Aiwit smartphone app and could be purchased from popular online retailers like Amazon, Shein, Temu, and Walmart.\u00a0<\/p>\n<\/div>\n Back in February, CR<\/em> reported that it found vulnerabilities in Eken-produced video doorbells<\/a> that \u201ccould allow a dangerous person to take control of the video doorbell on their target\u2019s home.\u201d <\/p>\n<\/div>\n Gaining access to the doorbell didn\u2019t even require any level of hacking knowledge: bad actors could simply download the Aiwit app, go to their target\u2019s home, and hold down the doorbell\u2019s button to pair it with their own smartphones, change their Wi-Fi network, and take control of the device.\u00a0<\/p>\n<\/div>\n Additionally, anyone with the doorbell\u2019s serial number could remotely view still images from the video feed \u2014\u00a0no password or account required, CR <\/em>security experts found. Doorbell owners didn\u2019t receive a notification of any kind if another user accessed their video feed in this manner. <\/p>\n<\/div>\n The doorbells also didn\u2019t encrypt the user\u2019s home IP address or Wi-Fi network, leaving both potentially exposed to criminals. <\/p>\n<\/div>\n The doorbells that CR<\/em> initially rated were sold under the brand names Eken and Tuck and seemed identical, down to them both requiring users to download the Aiwit smartphone app. <\/em>The group <\/em>later found 10 other seemingly identical doorbells made by Eken but sold under a number of different brand names.\u00a0<\/p>\n<\/div>\n CR<\/em> has reviewed Eken\u2019s firmware update and says the problem has been fixed. \u201cWhile we would prefer that products be safe and secure from their initial launch, the ability of our testing to uncover vulnerabilities results in better products for consumers,\u201d CR<\/em>\u2019s senior director of product testing, Maria Rerecich, said in its report.\u00a0<\/p>\n<\/div>\n As a result of CR<\/em>\u2019s reporting, the FCC has asked Amazon, Sears, Shein, Temu, and Walmart for more details<\/a> about how they vet products sold on their platform. None of the five retailers have responded to CR<\/em>\u2019s request for comment on the matter. <\/p>\n<\/div>\n Eken\u2019s video doorbells also lacked Federal Communications Commission ID labels, which are required by law, CR <\/em>found. The company has since added the FCC IDs to the electronic manuals for the doorbells.\u00a0<\/p>\n<\/div>\n Since CR<\/em> published its February report, many of the Eken doorbells have been pulled from online retailers. Notably, a number of the doorbells were selected as Amazon: Overall Picks or with the Amazon\u2019s Choice badge, a label with mysterious criteria<\/a> that Amazon has refused to explain fully and can be found on many dubious products. <\/p>\n<\/div>\n If you own an Eken-produced video doorbell, be sure to check if your firmware is up to date. Your doorbell should receive the update automatically, but it\u2019s smart to double-check. Go to the \u201cDevices\u201d page on the Aiwit app and tap on the doorbell\u2019s name, which should open up the settings. The firmware number should be 2.4.1 or higher, which indicates it\u2019s up to date. <\/p>\n<\/div>\n<\/div>\n