Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Low | 1.3 | CVE-2026-116115 |
A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36
Yoosee, Gwell Times, Grain MediaYoosee GM8135S Camera, Grain Media GM8135S, Gwell Times Yoosee GM8135S Camera
|
NVD | |||
|
CVE-2026-116115A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36
Executive summaryA smart camera sold as the Yoosee GM8135S, with firmware version 21.00.01.36 and possibly other versions, sends live video over the network in cleartext, so a nearby or network-positioned attacker can intercept and rebuild the stream. The camera also auto-connects to open WiFi networks without a password, which makes interception easier. The advisory states that the vendor has not released a firmware update, and its recommended mitigations are to isolate the camera on a separate network, use a self-hosted secure recorder or proxy, or switch to devices that encrypt traffic by default. Technical summaryThe advisory classifies the issues as cleartext transmission of sensitive information (CWE-319), insecure default initialization of resources (CWE-1188), and insufficient verification of data authenticity (CWE-345). An attacker positioned on the network path or within WiFi range can capture unencrypted UDP video frames during an active live stream without authenticating to the camera. The camera automatically connects to open SSIDs named Free-AP0 through Free-AP3 with no password, and the advisory describes forcing a reconnection by deauthentication. The advisory also says the SPI flash firmware is not verified, so an attacker could modify and reflash it. Affected versions are stated as up to and including 21.00.01.36, possibly others. A fixed version is not stated, and the advisory says no firmware update has been released as of publication. Recommended workarounds are network isolation, using a secure RTSP proxy or NVR, and wiring the device by Ethernet to avoid WiFi auto-connection. No CVSS score or in-the-wild exploitation is stated, and no specific detection guidance is given beyond the sniffing setup described in the write-up. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from akosibrylle.me/writeups/yoosee-cve Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsYooseeGwell TimesGrain MediaYoosee GM8135S CameraGrain Media GM8135SGwell Times Yoosee GM8135S Camera
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||