← Blog

Refresh: Wyze's real RTSP status, Dahua's Operation CameraSwarm, and an encryption claim we'd undersold

2026-09-01

This cycle we refreshed Genetec Security Center, Avigilon Unity, Imou, Dahua, and Wyze. Here's what changed:

**Genetec Security Center**: current build is 5.14.1.1 (17 August 2026). We re-checked Fusion Stream Encryption against the 5.14 documentation: it does encrypt video archives at rest (AES-128, keys rotating every minute), confirming what we already had on file — but see the Noviscan correction below.

**Avigilon Unity**: no version specifics could be confirmed from public documentation this cycle (Avigilon's release-notes portal requires a login), but the vendor's own security page states data is encrypted "in transit and at rest" at the platform level, consistent with our existing FIPS-mode entry.

**Imou**: no new CVE surfaced in a dated search this cycle. Existing entries (CVE-2023-6913, cloud/account requirements) remain current.

**Dahua**: independent research published in August 2026 as "Operation CameraSwarm" found 14,500+ Dahua devices compromised between 17 June and 22 July 2026 — mostly via weak or default passwords, about 1,900 through the already-known CVE-2021-33044/33045 authentication bypass, and 283 through the P2P (Easy4IP) relay path itself. Dahua confirmed the report and pointed back to its 2021 advisories — no new zero-day, but a reminder that the "P2P is just optional" framing understates real-world exposure when a fraction of compromises go through that exact path.

**Wyze**: this is the one correction worth flagging on our own copy, not just a competitor's. Our entry said RTSP was "a stale beta pulled in 2026" — true for the oldest v1/v2/Pan v1 models, but wrong for Cam v3 and Pan v3, which received official, vendor-supported local RTSP in a February 2026 firmware update and have kept it since. The current V4 line still has none (in development since January 2026, no committed date per Wyze's own forum). We've rewritten the entry to reflect the actual per-model split instead of treating the brand as uniformly closed on this point.

**Noviscan cross-check**: re-verifying Genetec and Avigilon this cycle surfaced an omission in our own Noviscan entry. Its encryption-at-rest strength claim named Synology, Nx Witness, and Milestone as "the few other VMS that encrypt at rest at all" — but Genetec's Fusion Stream Encryption and Avigilon's FIPS-mode encryption both do too, just as an opt-in rather than a default. We corrected the wording to include them: the differentiator is that Noviscan encrypts by default, not that it's the only one that can encrypt at all.