The vulnerability stems from older cloud feature modules in the EZVIZ app that expose legacy API interfaces without proper encryption. Attackers can intercept network traffic to capture data transmitted by these modules, potentially revealing sensitive information. This issue represents a confidentiality risk due to clear‑text data transmission, aligning with CWE‑312.

Older versions of the EZVIZ app, which incorporate legacy cloud feature modules with unencrypted interfaces, are affected. The specific versions are not enumerated in the advisory, but any app build employing these older modules may be vulnerable.

With a CVSS score of 5.3, the vulnerability is rated as moderate in severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers would need network access to eavesdrop on traffic; authentication is not required. The primary exploit path involves intercepting unencrypted API requests, allowing passive data capture without active intrusion.