Executive brief
Bird's smart video doorbell (D1101V-F model) has a critical flaw in its authentication mechanism that allows attackers to gain unauthorized access. The doorbell broadcasts user account information over unencrypted network packets, and the weak password scheme combined with a flawed key derivation process enables attackers to brute-force credentials and control the door lock remotely, potentially allowing unauthorized entry.
Technical details
The vulnerability stems from two related flaws: (1) the doorbell broadcasts unencrypted UDP packets containing the username prefix to the entire network, immediately disclosing account identifiers; and (2) the password validation process uses a weak key derivation scheme vulnerable to brute-force attacks. Default passwords follow the pattern [a-zA-Z0-9]{10}, yielding approximately 2^60 possible combinations. The encrypted AEAD datagrams sent over UDP can be decrypted once valid credentials are derived. An attacker on the network can passively collect broadcast packets to learn the username prefix, then brute-force the password against the weak KDF to authenticate and control the attached relay (typically connected to a door lock). No authentication or special privileges are required to listen to broadcasts; the attack surface is network-accessible.
Affected products
- Bird Home Automation GmbH D1101V-F 000140
Timeline
- 2026-08-26: disclosed: CVE-2023-42179 published on NVD