The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Consumer Reports found serious security flaws in a family of inexpensive wireless video doorbells made by Eken Group Ltd. and sold under multiple brand names through online marketplaces. The affected ecosystem centered on the Aiwit app. A nearby person could potentially claim ownership of a doorbell, while separate flaws exposed camera still images, a home’s public IP address, and its Wi-Fi network name.
This was not evidence that every video doorbell—including Ring, Nest, Arlo, or SimpliSafe—could be easily hijacked. Eken later issued firmware fixes, but owners still need to identify their exact model and confirm that the update applies to it.
As an Amazon Associate I earn from qualifying purchases.
Is your doorbell part of the affected group?
Start with the companion app, not just the name printed on the box. Consumer Reports identified Eken and Tuck products, along with at least 10 apparently identical models sold under other labels, including Fishbot, Rakeblue, Andoe, Gemee, Luckwolf, Aiwit, and Sunnyjane.
- Does the doorbell use the Aiwit app?
- Is it an Eken, Tuck, or one of the other reported marketplace brands?
- Does its physical design and packaging resemble generic Eken/Tuck hardware?
- Can you identify a model number and installed firmware version?
- Does the app offer a firmware update?
This list is not exhaustive. Rebranded hardware can appear under different seller and product names, and firmware numbers may vary by model. A brand name alone is therefore an unreliable way to clear a device.
#1 Best Overall
- AI-Powered Smart Detection: Advanced AI technology accurately identifies people while filtering out vehicles and animals, so you only get the alerts that matter most
- Secure Cloud Storage: Protect your recordings with AES-128 encrypted cloud storage
- Pre-Capture Recording: Cloud subscribers benefit from pre-capture functionality, ensuring the camera starts recording right at the moment motion begins - never miss a thing
- Reliable 2.4GHz Wi-Fi Connection: Optimized for 2.4GHz networks to deliver stable, uninterrupted performance. (Not compatible with 5GHz Wi-Fi.)
- Exceptional Night Vision: Equipped with four powerful infrared LEDs and an advanced image sensor, providing sharp, detailed footage even in total darkness
Consumer Reports’ original investigation, published on February 29, 2024, found eight Eken listings and three Tuck listings on Amazon. Those listings recorded more than 4,200 sales in January 2024. Similar products were also found on Walmart, Sears, Shein, and Temu. These are historical figures, not current marketplace totals. Consumer Reports’ investigation explains the reported products and sales.
What researchers found
| Problem | Potential consequence | Reported risk |
|---|---|---|
| Weak ownership and pairing controls | A nearby attacker could potentially claim the doorbell through the Aiwit app, view the device, control it, and lock out the legitimate owner. | High |
| Unauthenticated image access | Still images could be retrieved from a server URL if an attacker obtained the doorbell’s serial number. | High |
| Unencrypted public IP transmission | The household’s public-facing IP address could be exposed during device communications. | Medium |
| Unencrypted Wi-Fi name transmission | The name of the local Wi-Fi network, or SSID, could be exposed. | Medium |
The Wi-Fi finding needs careful interpretation. An exposed SSID does not reveal the Wi-Fi password or automatically provide access to the network. It can nevertheless help with household identification and network reconnaissance, particularly when combined with other information.
The image flaw also should not be described as proof that anyone anywhere could continuously watch live video. Consumer Reports reported access to still images when the serial number was obtained. That is a different scenario from a remote live-feed takeover.
Recommended Free Tools
How the ownership takeover worked
The ownership attack required physical proximity to the doorbell. According to Consumer Reports’ disclosure, an attacker could download the Aiwit app, create an account, and place the device into pairing mode by holding its physical button for approximately eight seconds. The attacker then presented an app-generated QR code to the doorbell’s camera so the device could be associated with the attacker’s account.
The weakness was not simply that pairing existed. The problem was that the pairing and reset process did not provide adequate authorization or protection for the existing owner. Once associated, the attacker could potentially view the camera, control the device, and prevent the legitimate owner from using it normally.
Consumer Reports rated the unauthorized-ownership flaw as high risk, with high exploitability and high impact. Because the attacker had to interact with the physical unit, this was not described as a takeover that could be launched remotely from anywhere. The separate serial-number image issue had a different threat model.
Rank #2
- Wide 166° Field Of View For Video Doorbell & f/2.5 Aperture: Covers your front porch with no blind spots; CMOS sensor and f/2.5 aperture deliver moderate depth of field with soft background blur and crisp facial details for fast visitor recognition
- Reliable 2.4 GHz Wi‑Fi & 1.2T AI Chip With Fast, Stable Response: This wireless video doorbell supports only 2.4 GHz Wi‑Fi for improved signal penetration and range; high‑speed AI chip processes thousands of operations per second for instant alerts and enhanced security
- No Subscription Required & Full Access to Essential Features With Zero Hidden Costs: Get real-time alerts, two-way audio, human detection, and video playback with this doorbell camera, with no subscription required; all essential features stay free, optional subscription plans are available for advanced services such as cloud storage and enhanced AI event classification
- HDR Night Vision With Invisible 940 nm Infrared: HDR tech and high-sensitivity sensor in this doorbell camera adjust to all lighting conditions; invisible 940 nm IR fill light offers clear night vision up to 10 meters without red glow for discreet, around-the-clock security
- Battery Life & Usage Tips for Your Doorbell Camera: In laboratory conditions, the battery lasts up to 60 days with 30 daily motion activations and 10-second video recordings; actual performance may vary based on usage and environment; extend battery life by adjusting motion sensitivity, narrowing detection zones, or avoiding high-traffic areas. (Powered by a built-in, non-removable rechargeable battery for wire-free operation.)
For technical details, see the Consumer Reports vulnerability disclosure.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What happened after the disclosure?
Eken met with Consumer Reports and released a firmware update. In April 2024, Consumer Reports reported that the update fixed the vulnerabilities it had tested. It removed its “Don’t Buy: Safety Risk” labels from the Eken Smart Video Doorbell and Tuck Sharkpop after confirming the reported fixes.
Consumer Reports identified firmware version 2.4.1 or higher as corrected guidance for some affected models. That number should not be treated as a universal requirement for every Aiwit-based doorbell. Verify the version and update process for the exact brand and model.
In November 2024, the Federal Communications Commission proposed a $734,872 fine against Eken in an action stemming from the investigation. The amount was proposed, not necessarily a final collected penalty. The original reporting also found that some devices lacked required visible FCC identification labels. Eken later said it had added FCC IDs to electronic manuals and would address labeling. FCC labeling compliance is separate from cybersecurity: a visible FCC ID does not prove that a device’s software is secure, and missing labeling is not proof that a particular camera has been hacked.
These developments improve the situation, but they do not establish that every rebranded model received the same patch or that every old marketplace listing has disappeared. Sellers, regions, inventory, and update channels can differ.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat owners should do now
If your doorbell uses Aiwit
- Open the Aiwit app and locate the device-information, settings, or firmware screen.
- Record the brand, model, serial number, and installed firmware version.
- Install the latest firmware offered by the app.
- Check the manufacturer’s support information for model-specific confirmation. For some affected models, Consumer Reports identified version 2.4.1 or higher.
- Change the Aiwit account password to a strong, unique password.
- Enable multifactor authentication if the app or account supports it.
- Review account ownership, shared users, connected devices, and active sessions.
- Remove unfamiliar users or devices and confirm that you remain the owner.
If there is no update, the manufacturer cannot identify the model’s security status, or the app cannot remove a previous owner, replacement is the safer choice. Do not assume that a factory reset alone resolves an ownership problem; confirm the ownership state in the app afterward.
Rank #3
- Capture it all with Retinal 2K video — From wide views to tighter focus, it’s easy to see your home or business in crisp clarity with Retinal 2K.
- Zoom in up to 6x — Catch details at a distance, inspect faces, and more with up to 6x Enhanced Zoom.
- Connect to who’s there — See, hear, and speak in real time with Live View and Two-Way Talk.
- Get real-time alerts — Receive real-time notifications on your phone when motion is detected.
- Easily recharge — Simply insert the included removal tool to detach your doorbell from the wall, then recharge the built-in battery via USB-C. (Cable not included.)
If you suspect compromise
- Disconnect the doorbell from Wi-Fi or remove its battery, if practical and safe.
- Change the account password from a trusted device.
- Revoke shared access and remove unfamiliar sessions.
- Review your router’s connected-device list and available logs.
- Change the home Wi-Fi password if there is evidence that credentials—not merely the network name—were exposed.
- Save ownership-change alerts, emails, screenshots, and purchase records.
- Contact the manufacturer and retailer. If stalking or domestic abuse is involved, consider a relevant support service or law-enforcement agency.
When replacement is the better decision
Updating is reasonable when the doorbell is clearly identifiable, the app supplies a current update, the model is covered by the manufacturer’s support channel, and ownership appears normal.
Replace it when:
- No firmware update is available.
- The brand, model, or manufacturer cannot be identified.
- The device remains linked to an unknown account.
- The vendor has no meaningful security-support or vulnerability-reporting process.
- The camera protects a high-risk household, particularly one affected by stalking or domestic abuse.
- Unusual image or network exposure continues after updating.
How to choose a safer replacement
Do not evaluate a connected doorbell solely by resolution, review count, price, or a marketplace badge. Consumer Reports found that at least one affected product carried an “Amazon’s Choice” badge. Such labels measure commerce or popularity, not secure authentication and responsible update practices.
Before buying, look for:
- A clearly identified manufacturer and model number.
- A published firmware-support period and a dependable update mechanism.
- Multifactor authentication.
- A documented security-contact or vulnerability-reporting process.
- Clear privacy, retention, and data-sharing policies.
- Signed or otherwise protected firmware updates.
- The ability to remove a device from an old account.
- Local-storage or local-processing options if reducing cloud exposure matters to you.
- Independent privacy and security testing, not only video-quality reviews.
- Required regulatory identification information where applicable.
Cloud-dependent products are often easier to access remotely, but they create account, server, and data-retention risks. Local-storage systems may reduce cloud exposure while shifting responsibility for encryption, backups, remote access, and physical security to the owner. Battery models are easier to install but may wake more slowly and depend on charging; wired models are generally more consistent but require electrical compatibility and safe installation.
Official product pages for established ecosystems include Ring, SimpliSafe, Logitech, Google Nest, and Arlo. These brands should not be described as risk-free or as part of the specific Eken investigation. Check current model availability, compatibility, support terms, privacy policies, and subscription requirements before purchasing.
The broader lesson for marketplace buyers
This incident was a supply-chain problem as much as a brand problem. Several labels apparently shared hardware, software, and manufacturer infrastructure. Avoiding one name is not enough if the same device returns under another name with the same Aiwit app and generic design.
A video doorbell is a security product pointed at a home, not merely a low-cost camera. Authentication, ownership recovery, firmware support, data protection, and vendor accountability deserve at least as much attention as motion detection and image quality.
Consumer Reports’ later update is important: the tested Eken and Tuck vulnerabilities were reported as fixed. But a fix for tested devices is not proof that every rebrand, seller inventory, or future model has identical protection. Identify the exact device, verify its firmware, and replace it when the manufacturer cannot provide a clear answer.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
