Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| High | 8.4 | CVE-2026-116116 |
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36
Yoosee, Shenzhen Gwell Times Technology, Gwell TimesYoosee GM8135S Camera, Shenzhen Gwell Times Technology Yoosee GM8135S Camera, Gwell Times Yoosee Smart Camera, Grain Media GM8135S
|
NVD | |||
|
CVE-2026-116116A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36
Executive summaryA smart camera sold under the Yoosee name, model GM8135S with firmware 21.00.01.36 and possibly other versions, sends live video over the network without encryption, so anyone positioned on the network path can watch the stream. The advisory describes this as a zero-day with no vendor fix yet, and it recommends isolating the camera on a separate network with no outbound internet access, or replacing it with a device that encrypts traffic by default. Technical summaryThe advisory describes cleartext transmission of sensitive information (CWE-319), insecure default initialization (CWE-1188), and insufficient verification of data authenticity (CWE-345). An attacker on the network path can capture UDP video packets during an active live stream and reconstruct H.264 video, and the device auto-connects to open Wi-Fi SSIDs named Free-AP0 through Free-AP3 without a password, which enables proximity attacks through deauthentication. Firmware in the SPI flash is not verified, so it can be modified and reflashed, and the advisory states no authentication is needed. Affected versions are stated as up to and including 21.00.01.36, possibly others. No fixed version is stated, and the vendor has not released a firmware update. The advisory gives no detection guidance and no CVSS score is stated. Mitigations are network isolation, blocking outbound internet access, using a self-hosted NVR or TLS reverse proxy for local RTSP, and connecting the device by Ethernet. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from akosibrylle.me/writeups/yoosee-cve Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsYooseeShenzhen Gwell Times TechnologyGwell TimesGrain MediaYoosee GM8135S CameraShenzhen Gwell Times Technology Yoosee GM8135S CameraGwell Times Yoosee Smart CameraGrain Media GM8135S
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 1.3 | CVE-2026-116115 |
A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36
Yoosee, Gwell Times, Grain MediaYoosee GM8135S Camera, Grain Media GM8135S, Gwell Times Yoosee GM8135S Camera
|
NVD | |||
|
CVE-2026-116115A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36
Executive summaryA smart camera sold as the Yoosee GM8135S, with firmware version 21.00.01.36 and possibly other versions, sends live video over the network in cleartext, so a nearby or network-positioned attacker can intercept and rebuild the stream. The camera also auto-connects to open WiFi networks without a password, which makes interception easier. The advisory states that the vendor has not released a firmware update, and its recommended mitigations are to isolate the camera on a separate network, use a self-hosted secure recorder or proxy, or switch to devices that encrypt traffic by default. Technical summaryThe advisory classifies the issues as cleartext transmission of sensitive information (CWE-319), insecure default initialization of resources (CWE-1188), and insufficient verification of data authenticity (CWE-345). An attacker positioned on the network path or within WiFi range can capture unencrypted UDP video frames during an active live stream without authenticating to the camera. The camera automatically connects to open SSIDs named Free-AP0 through Free-AP3 with no password, and the advisory describes forcing a reconnection by deauthentication. The advisory also says the SPI flash firmware is not verified, so an attacker could modify and reflash it. Affected versions are stated as up to and including 21.00.01.36, possibly others. A fixed version is not stated, and the advisory says no firmware update has been released as of publication. Recommended workarounds are network isolation, using a secure RTSP proxy or NVR, and wiring the device by Ethernet to avoid WiFi auto-connection. No CVSS score or in-the-wild exploitation is stated, and no specific detection guidance is given beyond the sniffing setup described in the write-up. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from akosibrylle.me/writeups/yoosee-cve Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsYooseeGwell TimesGrain MediaYoosee GM8135S CameraGrain Media GM8135SGwell Times Yoosee GM8135S Camera
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||