logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown

nihildiximus 8529 21

TL;DR LABEL_AI_GENERATED

  • The teardown examines the Ezviz C6C (CS-CV246, A0-3B1WFR) cheap Wi‑Fi camera.
  • Inside, it uses an STM8S003F3 microcontroller and exposes Hikvision protocol on port 8000 plus RTSP on port 554.
  • The camera can be dismantled and reassembled non-invasively: bottom screws hide under the rubber band, and the head is secured with latches.
  • No alternative software exists yet, and the other circuits are shown in the photos as legibly as possible.
AI summary based on the discussion. May contain errors.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
Listen:
  • Producer: Ezvis
    Model: C6C (CS-CV246, A0-3B1WFR)
    Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown

    Description: Cheap Wifi camera by Ezviz operating via Hikvision protocol on port 8000 with RTSP on port 554. Based on STM8S003F3 (8S003F3P6) microcontroller (16-MHz STM8S 8-bit MCU, 8Kb flash, 128b EEPROM, 10-bit ADC, UART, SPI, I²C). The other circuits are visible in the pictures - I tried to make them legible. At the moment there is no alternative software. The device itself can be dismantled and assembled completely non-invasively (housing screws are located under the rubber band from the bottom - the rest are not hidden, the "head" of the camera is closed with latches).

    Teardown photos:
    Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown

    Cool? Ranking DIY
    eufyMake E1 - łatwa personalizacja za pomocą druku UV [sponsorowany]
    About Author
    nihildiximus
    Level 9  
    Offline 
    nihildiximus wrote 32 posts with rating 23, helped 1 times. Live in city Wrocław. Been with us since 2018 year.
  • ADVERTISEMENT
  • #2 20552781
    gulson
    System Administrator  
    Posts: 29514
    Help: 150
    Rate: 6116
    Thanks for showing the inside. The camera is very cheap, only PLN 160. Does it send any data to an external cloud? Can you just connect to Hikvision cameras?
  • #3 20552882
    Anonymous
    Level 1  

  • Firmware updates disable RTSP by default

    #4 20552929
    robig
    Level 24  
    Posts: 462
    Help: 62
    Rate: 145
    Hi

    In addition, in recent camera firmware updates, EZVIZ began to mess with the RTSP stream, turning off the stream by default, thus "encouraging" users to use the cloud or memory cards to record events. In the thematic app, you can easily turn on RTSP using the original app, although the option is hidden, but for example, in the DP2C door viewfinder, there is no such option, also through EZVIZ Studio ... So if someone uses cameras of this brand and RTSP stream, then let go of the firmware updates.

  • RTSP must be re-enabled on the local network

    #5 20553250
    nihildiximus
    Level 9  
    Posts: 32
    Help: 1
    Rate: 23
    The advantage of cameras is that they are cheap. The downside is that after about a year, the two cameras do not keep the settings and after the power is cut off, they need to be reconfigured. I did not make a major diagnosis, but the 3.3V battery visible in the pictures had the correct voltage during the demolition. FW updates automatically, so I had to re-enable RTSP. The problem is that this option can only be enabled in the local network to which the camera is connected (it is in the local camera settings). When offline, there are no options in the app. Another minus is that I have not seen that the Ezviza intercom has neither rtsp nor the possibility of downloading the stream otherwise than through the application - there is even no possibility of connecting it to the NVR. An alternative soft for these devices would be very useful, or some kind of patent for controlling them through port 8000 and downloading the stream through this port, which would enable the creation of an independent application operating without the cloud.

    Added after 1 [minutes]:

    So far I haven't had time to sit down to it, but I think you can start testing from this: https://www.docdroid.net/wlD2i8v/hikvision-isapi-26-ipmd-service-pdf#page=22

  • Hikvision protocol enables NVR use without cloud

    #6 20553704
    kotbury
    Gantry automation specialist  
    Posts: 9598
    Help: 2100
    Rate: 3631
    Maybe a little off the topic of changing the firmware, but since the camera works on the HikVision protocol, it will work with almost any NVR (including basic PTZ functions), and this can usually be forced to work not via the cloud, but via TCP with a dedicated smart app or computer and we have independence from the PRC and their servers.
    However, there is another dependence on something - for the NVR we must have a fixed external IP or use DynDNS services. Well, but you also need to have the net and be dependent on its provider.
    This operation is a bit lame, but the less so, the more branded the NVR is.
    Anyway, you can do the same with the webcam itself if it has a web server. Does the camera have this option?
  • ADVERTISEMENT
  • #7 20554523
    chemik_16
    Level 27  
    Posts: 1001
    Help: 75
    Rate: 128
    I have a whole box of IP cameras, I'm counting on projects in the style
    https://github.com/OpenIPC/firmware

    because all these cloud freaks are the same problems, not to mention security.

  • Web server access would enable local camera control

    #8 20554805
    elektryku5
    Level 39  
    Posts: 6303
    Help: 460
    Rate: 1055
    kotbury wrote:
    Anyway, you can do the same with the webcam itself if it has a web server. Does the camera have this option?


    I do not know about this model, but I once had the misfortune of configuring another camera-like product from the land of rice, no www, no possibility to connect the application via LAN, preview only via the cloud ...

    chemik_16 wrote:
    I have a whole carton of IP cameras, I'm counting on projects in the style


    It would be nice if this developed, because even apart from security issues, you can often get a headache on the factory camera and recorder software when it works as it pleases.
  • ADVERTISEMENT
  • #9 20556121
    rusudanion
    Level 4  
    Posts: 6
    Hello i have two ezviz camera ,they are not unbind from account. works only in lan mode . Can i use in other mode ?
  • #10 20556602
    Daroken
    Level 10  
    Posts: 86
    Rate: 5
    I recently bought a similar XIAOMI Mi Home Security Camera 360 PTZ 2K Pro. How to take strim from it because I want to use it in Home Assistant.
  • ADVERTISEMENT
  • #11 20557100
    chemik_16
    Level 27  
    Posts: 1001
    Help: 75
    Rate: 128
    You can't, you need to look for alternative software. Or ride through the clouds.
  • #12 20558398
    robig
    Level 24  
    Posts: 462
    Help: 62
    Rate: 145
    Can a friend recommend such an app?

    kotbury wrote:
    since the camera works on the HikVision protocol, it will work with almost any NVR (including basic PTZ functions), and this can usually be forced to work not via the cloud, but via TCP with a dedicated app for a smart or computer, and we are independent of the PRC and their servers .

  • Need to verify web configuration support

    #13 20558431
    kotbury
    Gantry automation specialist  
    Posts: 9598
    Help: 2100
    Rate: 3631
    Adult registrars have a dedicated app, but personalized for a specific company; for example, in the case of BCS, Dahuy, these are different types of DMSS, HikVision devices have the BitVision app, personally I have all the equipment (both cameras and recorder) based on Xionmaitech chipsets, i.e. XAI - it comes with this (and cameras, and NVR) ISS Mobile 1.5 app .7 (which is not in GooglePlay). So that's a lot of searching and matching with no guarantee it will work. And the basis - the equipment must be able to connect and configure via www. And whether the title camera has such a possibility at all - to be checked.
    Monitoring experts may write more (I'm rather an amateur myself).
  • #14 20559745
    Daroken
    Level 10  
    Posts: 86
    Rate: 5
    chemik_16 wrote:
    You can't, you need to look for alternative software. Or ride through the clouds.
    Can you tell me more about alternative software?
  • #15 20561958
    Duch__
    Level 31  
    Posts: 2338
    Help: 33
    Rate: 1598
    It's a pity that in these cameras Ezviz does not go to set presets.
  • #16 20565743
    nobanmeplease
    Level 16  
    Posts: 232
    Help: 7
    Rate: 20
    Maybe someone will make a list of cheap outdoor IP cameras and PTZ, which can be technically configured inside the local network without external clouds and unreliable applications?
    This would greatly help in the selection of equipment for budget installations that emphasize discretion and simplicity when servicing in closed networks.
  • #17 20572884
    Daroken
    Level 10  
    Posts: 86
    Rate: 5
    How is access to a stream blocked?
    If strim goes through the cloud how does it work?

  • Closed-network cameras rely on DHCP without a gateway

    #18 20577885
    nobanmeplease
    Level 16  
    Posts: 232
    Help: 7
    Rate: 20
    Daroken wrote:
    How is access to a stream blocked?
    If strim goes through the cloud, how does it work?

    When it comes to the smart IP cameras themselves, there is no blockage here. Normally, the camera's API architecture is client-based and connects to the domain name through which access to stream, settings, etc. is made.
    As for closed networks, they are simply listening to the DHCP server that reserves ipv4 for MAC addresses and there is no configured gateway to the network above.
  • #19 20579329
    Daroken
    Level 10  
    Posts: 86
    Rate: 5
    How can you take over strim to the cloud to view the image directly in the local network?
  • #20 20579908
    nobanmeplease
    Level 16  
    Posts: 232
    Help: 7
    Rate: 20
    This is a river topic dedicated to those who sit at CTFs. When I get such a camera, I will use wireshark to examine the packets and maybe I can somehow cheat certificates or find some very lame implementation of the protocol.

  • New Ingenic T31 and T21 camera models support OpenIPC

    #21 20773129
    chemik_16
    Level 27  
    Posts: 1001
    Help: 75
    Rate: 128
    Of interest - I ordered some fresh IP cameras from china, new models. They are worth your interest, they are based on new Ingenic processors with AI module.
    One with two lenses - one fixed one PTZ, based on ingenic T31. Plus wifi + LAN. Cost approx. 110zł - a whole bunch of clones on ali.
    The other with one, rectangular bullet type - T21, only for cable. About 60-70zł.

    And why is it worthy of interest ? These are already quite powerful CPUs for such cheap cameras
    http://www.ingenic.com.cn/en/?product/id/20.html

    They expose Onvif by default,
    they have SDK available, so there are alternative FW OpenIPC for them.
    They have 4M-5Mpx sensors, medium quality, but it's 2K/4K at the price of recent 720/1080p - which were also usually useless due to very weak cpu and small amount of ram.

    Tomorrow or the day after tomorrow I will find a moment, I can insert teardown.
  • #22 20773138
    gulson
    System Administrator  
    Posts: 29514
    Help: 150
    Rate: 6116
    It would be great if you could find a moment and show off, in the form of a short review, how they work and how they behave.
Reply Cool? Ranking DIY | New topic
Notify about new articles
Listen:
Report a violation of the law

Topic summary

LABEL_AI_GENERATED
The discussion revolves around the Ezviz C6C (CS-CV246, A0-3B1WFR) camera teardown, highlighting its low cost and basic functionality. Users express concerns about the camera's reliance on cloud services, with firmware updates disabling RTSP streaming by default, pushing users towards cloud storage. The camera operates on Hikvision protocols, allowing potential compatibility with various NVRs, but users report issues with settings retention and the need for reconfiguration after power loss. There is a call for alternative software solutions to enhance functionality and independence from cloud services. Users also share experiences with other brands and models, discussing the need for local network configurations and the potential for using alternative firmware.
AI summary based on the discussion. May contain errors.
Today's popular

FAQ LABEL_AI_GENERATED

TL;DR: 15 answers, "RTSP hidden" explains how Ezviz C6C teardown owners can restore port 554 streaming, assess STM8S003F3 hardware, and avoid cloud lock-in when using NVRs, Hikvision port 8000, or ONVIF alternatives. [#20552929]

Why it matters: Cheap cloud cameras can lose local-recording value when firmware, account binding, or missing web access blocks independent operation.

Option Local access noted in thread Cloud dependence Approx. cost
Ezviz C6C CS-CV246 RTSP 554, Hikvision 8000 Ezviz proprietary cloud also present 160 PLN
Xiaomi Mi Home Security Camera 360 PTZ 2K Pro No direct stream given Cloud or alternative firmware Not stated
Ingenic T21 bullet camera ONVIF by default Lower, with OpenIPC path 60–70 PLN
Ingenic T31 dual-lens PTZ clone ONVIF by default Lower, with OpenIPC path 110 PLN

Key insight: The best local-recording path is not the cheapest cloud camera. Choose hardware exposing RTSP, Hikvision protocol, or ONVIF before purchase.

Quick Facts

  • Ezviz C6C CS-CV246 A0-3B1WFR uses RTSP on port 554 and Hikvision protocol on port 8000. [#20552587]
  • The visible control MCU is STM8S003F3P6: 16 MHz, 8-bit STM8S, 8 KB flash, 128 B EEPROM, 10-bit ADC, UART, SPI, and I²C. [#20552587]
  • The housing opens non-invasively: bottom screws sit under a rubber band, and the camera head uses latches. [#20552587]
  • A forum user reported two cameras losing settings after about 1 year, despite a 3.3 V battery measuring correctly during disassembly. [#20553250]
  • Cheap Ingenic alternatives mentioned later expose ONVIF by default: T21 bullet models cost about 60–70 PLN, and T31 dual-lens PTZ clones about 110 PLN. [#20773129]

How do you safely disassemble an Ezviz C6C CS-CV246 camera without damaging the housing or camera head latches?

Disassemble it non-invasively by removing the hidden bottom screws first, then opening the head latches carefully.
  1. Peel back the rubber band on the bottom.
  2. Remove the housing screws located underneath it.
  3. Release the camera head latches without prying the shell apart violently. The thread states the remaining screws are not hidden, so forced cutting is unnecessary. [#20552587]

What hardware components are inside the Ezviz C6C CS-CV246 A0-3B1WFR, including the STM8S003F3 microcontroller?

The Ezviz C6C contains an STM8S003F3P6 microcontroller and camera boards shown in teardown photos. "STM8S003F3 is an 8-bit microcontroller that handles embedded control tasks, with 16 MHz clocking, 8 KB flash, 128 B EEPROM, 10-bit ADC, UART, SPI, and I²C interfaces." Other circuits were photographed, but no alternative firmware was available at teardown time. [#20552587]

How can RTSP be enabled again on an Ezviz camera after a firmware update disables the stream by default?

Enable RTSP again inside the original Ezviz app while the phone and camera share the same local network. The RTSP option sits in local camera settings. Firmware updates can disable the stream by default. The option is hidden, and offline mode does not expose those settings in the app. One user warned: if RTSP matters, skip Ezviz firmware updates. [#20553250]

Why do some Ezviz C6C cameras lose their settings after a power cut, even when the 3.3 V battery still measures correctly?

Two Ezviz cameras reportedly stopped retaining settings after about 1 year, even though the 3.3 V battery measured correctly. The thread does not identify a confirmed component fault. The verified failure mode is clear: after power loss, the cameras need reconfiguration. That makes unattended installations risky, even when the backup battery voltage looks normal during teardown. [#20553250]

What is RTSP and how is it used to view an IP camera stream on port 554?

RTSP provides the local video stream path used by this Ezviz C6C on port 554. "RTSP is a streaming control protocol that lets a client request live IP-camera video, commonly using a network URL and a dedicated service port such as 554." In this thread, RTSP matters because updates may turn it off, pushing users toward cloud or memory-card recording. [#20552929]

What is the Hikvision protocol on port 8000 and how does it relate to Ezviz cameras?

The Ezviz C6C works through Hikvision protocol on port 8000 because Ezviz is tied to the Hikvision ecosystem. "Hikvision protocol is a proprietary camera-control and video-access protocol that NVRs and client apps use over TCP, with port 8000 commonly used for device communication." The teardown author wanted a way to control the camera and download streams through this port without cloud dependence. [#20553250]

How does the Ezviz cloud proprietary protocol work compared with direct local RTSP or Hikvision protocol access?

Ezviz cloud uses a proprietary protocol, while RTSP 554 and Hikvision 8000 allow direct local access when enabled. In the thread, cloud access becomes the fallback when firmware hides or disables RTSP. Direct local access suits NVRs and closed LANs better. A forum reply explicitly described it as an “EZVIZ cloud proprietary protocol.” [#20552882]

How can an Ezviz C6C camera be connected to an NVR with basic PTZ functions without relying on the Ezviz cloud?

Connect it as a Hikvision-protocol camera to an NVR and use TCP rather than the Ezviz cloud. The thread says cameras using Hikvision protocol should work with almost any NVR, including basic PTZ functions. Remote access still needs infrastructure: a fixed external IP or DynDNS. The cleaner result comes from a more branded recorder. [#20553704]

What apps can be used to access Hikvision, Dahua, BCS, Xionmaitech, or Ezviz-compatible cameras over TCP instead of through the cloud?

Use the app matched to the recorder brand, but expect trial and error. The thread names DMSS for BCS or Dahua variants, BitVision for Hikvision devices, and ISS Mobile 1.5.7 for Xionmaitech/XAI chipsets. The key requirement is camera or NVR configuration through a web interface. Without web access, matching a TCP app has no guarantee. [#20558431]

How can someone use two Ezviz cameras that are still bound to another account and only work in LAN mode?

The thread gives no verified method to unbind those two Ezviz cameras or restore full cloud mode. The reported state is specific: two Ezviz cameras remain bound to another account and work only in LAN mode. For independent use, test local RTSP or Hikvision access inside the same network before relying on them for recording. [#20556121]

How can a Xiaomi Mi Home Security Camera 360 PTZ 2K Pro stream be used in Home Assistant?

The thread says it cannot be used directly and needs alternative firmware or cloud use. The Xiaomi model named is Mi Home Security Camera 360 PTZ 2K Pro. No working Home Assistant stream URL appears in the discussion. The concrete advice given was short: “You can’t,” unless you use alternative software or the cloud path. [#20557100]

What alternative firmware options such as OpenIPC are available for cheap IP cameras, and which chipsets are supported?

OpenIPC appears as the named alternative firmware path, especially for cheap cameras with suitable chipsets. The thread later highlights Ingenic T21 and T31 cameras because they expose ONVIF by default and have SDK availability. "OpenIPC is alternative firmware for IP cameras that can replace vendor software, enabling local control when the hardware chipset and boot path are supported." [#20773129]

Ezviz C6C vs cheap Ingenic T21/T31 ONVIF cameras — which is better for local network recording without cloud dependence?

Cheap Ingenic T21/T31 ONVIF cameras look better for cloud-free local recording in this thread. They expose ONVIF by default and have OpenIPC potential. The Ezviz C6C offers RTSP 554 and Hikvision 8000, but firmware updates may disable RTSP. Cost also favors Ingenic: T21 models were about 60–70 PLN, while a T31 dual-lens PTZ clone cost about 110 PLN. [#20773129]

How can Wireshark be used to inspect cloud camera traffic and investigate whether a local stream can be accessed directly?

Use Wireshark to capture camera packets, then inspect domains, certificates, and protocol behavior. The thread frames this as a CTF-style research task, not a guaranteed method. A user planned to test whether certificates could be tricked or whether the cloud protocol had a weak implementation. This is exploratory traffic analysis, not a confirmed Ezviz bypass. [#20579908]

What are ONVIF, DynDNS, DHCP reservation, and fixed external IP in the context of setting up IP cameras and NVR access?

ONVIF enables standards-based camera discovery and NVR integration; DynDNS maps changing IPs to a name. DHCP reservation fixes a camera’s local IPv4 address by MAC. A fixed external IP gives stable remote access to an NVR. The thread also notes closed networks can reserve IPv4 addresses and omit an upstream gateway for isolation. [#20577885]
AI summary based on the discussion. May contain errors.
ADVERTISEMENT