These devices, available under various names, were once prominently featured on major online retailers, including Amazon, Shein, and Temu.

Despite their popularity on platforms such as Temu, the Eken and Tuck branded video doorbells can turn into a real nightmare for consumers. The core of the problem lies in the devices’ security vulnerabilities that make them susceptible to easy hacking, thereby allowing unauthorized access to the live camera feed.

Consumer Reports scrutinized ten virtually identical doorbell cameras, all manufactured by the Eken Group and distributed under different names. These doorbells all operate with an accompanying app called Aiwit, which is the crux of the problem. Attackers do not need deep technical knowledge; they can simply download the Aiwit app, switch the doorbell into pairing mode with the press of a button, and connect it to their own Aiwit account. They can then pair the device with a Wi-Fi hotspot and gain control over it.

An intruder can thus monitor who comes and goes around the house, when residents leave, and who arrives home at what times. What’s more alarming is that once the attacker gains control, the rightful owner receives an email notification about the disconnection from their account. Although the owner can re-pair the doorbell with their profile, the issue doesn’t end there. During the period of control, the attacker can obtain the device’s serial number, which due to the company’s poor security systems, allows them to gain insight into the camera’s still images at any time. This doesn’t provide continuous video recording, but the still images can reveal the comings and goings around the house nonetheless.

Most concerning of all is that no password is needed to accomplish this. Anyone with the serial number can gain a glimpse into another person’s life, and there's no need even to have an account. The serial number only needs to be obtained and shared or made available on an online platform for anyone to view the images.

The report also notes that the devices contain such significant security flaws that they can expose the user’s home IP address and Wi-Fi network name, all without encryption. This presents a fertile ground for online criminal activities.

Following the report, Consumer Reports notified all retailers of the problem. Temu subsequently removed the Eken-manufactured video doorbells that use the Aiwit app from its offerings, but CR highlights that other similar products may still remain in the market under different names. Walmart also removed the implicated products from its listings, while Amazon, Sears, and Shein did not respond to the issue.