Research uncovers wireless exploit allowing local control of Wyze colour bulbs without disassembly

Researchers have demonstrated a method to manipulate Wyze WLPA19CV2 colour bulbs via a wireless exploit, bypassing cloud dependence and opening new possibilities for local control and firmware customisation.

Researchers have documented a wireless exploit for the Wyze WLPA19CV2 colour bulb that takes advantage of a factory test mode to load custom firmware without opening the device. According to the project notes, the method can be used to gain code execution, after which the bulb can be managed through a separate loader and integrated with ESPHome for Home Assistant. The appeal is straightforward: it offers local control over a product that was designed around cloud dependence.

The process relies on a precise power-cycling sequence. The project recommends flashing an ESP32S3 with “wyze-hijack-ap”, keeping it close to the bulb, then repeatedly cutting and restoring power until the bulb briefly turns blue before the exploit completes. After roughly half a minute, the light is expected to turn purple, signalling that the “wyze-loader” payload is active and broadcasting its own access point. Users can then connect to that access point at the local address shown by the loader and continue into the ESPHome setup.

The work has drawn attention because it removes the need for soldering or disassembly, a barrier that has long discouraged hobbyists from repurposing smart lighting hardware. A post on the Home Assistant community forum framed the method as a response to the lack of an open flashing path for the bulb, and suggested that the same technique might prove useful on other Wyze devices if similar factory modes exist. That makes the project relevant not only to individual users, but also to anyone assessing how much control consumer IoT products actually allow once they leave the box.

The underlying device is a standard smart colour bulb sold under the WLPA19CV2 model name. Wyze’s own documentation describes it as an app-controlled lighting product and warns against use with dimmer switches, while FCC filings confirm the model and show that Wyze Labs submitted the certification in January 2023. Separately, users on Wyze’s forums have reported differences in colour output and even network instability with some bulbs, which underlines the wider point: connected lighting can be convenient, but it remains a small computer on the home network and may not behave as predictably as a simple lamp.