CVE-2025-64983 Overview
CVE-2025-64983 affects Smart Video Doorbell firmware versions prior to 2.01.078. The device ships with active debug code that exposes a Telnet service on the local network. An attacker within adjacent network range can connect to the Telnet interface and gain access to the device. The flaw is classified as [CWE-489: Active Debug Code], a category covering production code that retains developer-facing debugging functionality. Successful exploitation compromises the confidentiality, integrity, and availability of the doorbell. Details are published in JVN Security Advisory JVN67185535.
Critical Impact
An adjacent-network attacker can reach an unauthenticated Telnet debug service on affected doorbells and take control of the device.
Affected Products
- Smart Video Doorbell firmware versions prior to 2.01.078
- Related product page: SwitchBot Video Doorbell
- Fixed in firmware version 2.01.078 and later
Discovery Timeline
- 2025-11-26 - CVE-2025-64983 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64983
Vulnerability Analysis
The vulnerability is an active debug code issue in the doorbell firmware. Debug functionality intended for development shipped in production builds. Specifically, the firmware runs a Telnet daemon that listens for incoming connections on the local network. Telnet is a clear-text remote administration protocol that provides shell-level access when authentication is weak, default, or absent. Because the service is reachable from any host on the same network segment, an attacker adjacent to the doorbell can connect and interact with the underlying operating system. This exposes the camera feed, configuration, credentials, and any paired accounts. It also gives the attacker a pivot point into the home or business network.
Root Cause
The root cause is failure to disable or remove debug interfaces before releasing production firmware. The Telnet service was left enabled in builds distributed to customers. This class of defect maps directly to [CWE-489]. Firmware versions below 2.01.078 retain the debug listener, while 2.01.078 removes or disables it.
Attack Vector
Exploitation requires network adjacency, meaning the attacker must be on the same Wi-Fi network or local segment as the device. No prior credentials or user interaction are required beyond low-level access privileges on the network. The attacker scans for the doorbell's IP address, connects to the Telnet port, and obtains a shell on the device. From there, the attacker can read live video, extract stored credentials, modify device behavior, or use the doorbell as a foothold for lateral movement.
No public proof-of-concept code has been published. Technical details describing the debug interface are available in the JVN Security Advisory JVN67185535.
Detection Methods for CVE-2025-64983
Indicators of Compromise
- Inbound or outbound TCP traffic on port 23 (Telnet) associated with the doorbell's MAC or IP address.
- Unexpected shell processes or new binaries executing on the device, observable through upstream router or firewall logs.
- Configuration changes on the doorbell that were not initiated by an administrator through the vendor mobile application.
Detection Strategies
- Perform an authenticated network scan of the LAN segment hosting IoT devices and flag any host with TCP 23 open.
- Correlate DHCP lease information for the doorbell's MAC prefix with active service banners collected during scans.
- Alert on any successful Telnet session originating from or terminating at the doorbell's IP.
Monitoring Recommendations
- Forward router, firewall, and wireless access point logs to a centralized SIEM for continuous review of IoT segment traffic.
- Baseline normal doorbell traffic patterns, such as cloud endpoints and RTSP flows, and alert on deviations.
- Monitor for new device fingerprints or open ports appearing on the IoT VLAN after firmware changes.
How to Mitigate CVE-2025-64983
Immediate Actions Required
- Update Smart Video Doorbell firmware to version 2.01.078 or later through the vendor's mobile application.
- Verify the firmware version after update and confirm that TCP port 23 is no longer accessible from the LAN.
- Rotate any credentials, Wi-Fi passphrases, or paired account secrets that may have been exposed on affected devices.
Patch Information
The vendor addressed the issue by removing or disabling the debug Telnet service in firmware 2.01.078. Refer to JVN Security Advisory JVN67185535 and the SwitchBot Video Doorbell product page for update instructions.
Workarounds
- Isolate the doorbell on a dedicated IoT VLAN or guest Wi-Fi network with no route to internal management or user subnets.
- Block inbound TCP 23 at the network gateway and between VLANs until the firmware update is confirmed applied.
- Restrict Wi-Fi access with WPA2 or WPA3 and rotate the pre-shared key to reduce the pool of adjacent attackers.
# Example: block Telnet to and from the doorbell IP on a Linux gateway
iptables -A FORWARD -p tcp --dport 23 -d 192.0.2.25 -j DROP
iptables -A FORWARD -p tcp --sport 23 -s 192.0.2.25 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
