The vulnerability comes from older cloud feature modules in the EZVIZ app that expose legacy API interfaces without encryption. This allows attackers to capture the data transmitted through these interfaces, potentially revealing sensitive information. The issue aligns with CWE‑319 (Improper Handling of Sensitive Information).

All versions of the EZVIZ app that incorporate legacy cloud feature modules are affected. The advisory does not list specific version numbers, so any build using these older modules may be vulnerable.

The CVSS score of 5.3 rates the vulnerability as moderate. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. An attacker would need access to the network environment in order to intercept unencrypted API traffic, thereby capturing data in transit. Based on the description, it is inferred that no user authentication is required because the flaw involves passive interception of data rather than active exploitation.