Yoosee GM8135S Camera CVE-2026-116114

Exploitation requires the attacker to be able to observe or capture the device's Live UDP H.264 video stream served from /npc/npc, which is sent in cleartext - in practice an on-path (MITM) or shared-network position (same LAN/Wi-Fi segment, upstream router, or other traffic-interception vantage). No authentication is required (PR:N) and no user interaction (UI:N), but the attack is rated high-complexity/difficult because it depends on obtaining that interception position rather than on sending a simple request. Impact is limited to disclosure of the video stream contents (confidentiality only); there is no integrity or availability effect. The affected build is 21.00.01.36; because the vendor did not respond, no patched version is confirmed.

This is a medium-severity information-disclosure issue (CVSS 4.0 base 6.3) whose real-world urgency is modest. The vector is network-reachable and requires no authentication (AV:N/PR:N/UI:N), but complexity is explicitly high (AC:H) and the input describes exploitability as 'difficult,' and the impact is limited to low confidentiality only (VC:L, with VI:N/VA:N) - there is no integrity or availability consequence. The CVSS 4.0 Exploit Maturity is E:P (proof-of-concept), consistent with the input showing a public PoC reference that is not verified as working exploit code; this is not the same as active exploitation. The vulnerability is NOT in CISA KEV and no EPSS score was provided in the input, so widespread or automated exploitation cannot be inferred from the data. The vuln.today decision label is 'this_month,' which aligns with the moderate severity and PoC-but-not-weaponized posture - a patch-on-normal-cadence item rather than an emergency. The main caveat for defenders: no vendor advisory exists (the vendor did not respond), so there is no confirmed fix, and no EPSS/KEV signal is available to refine the exploitation-likelihood picture.

An attacker positioned to observe the camera's network traffic (for example on the same LAN/Wi-Fi segment or on an on-path node) passively captures the Live UDP H.264 video stream served by /npc/npc, which is transmitted without encryption, and reconstructs the sensitive video feed. A public PoC reference (a writeup) exists but is not verified as working exploit code, and the input rates practical exploitation as difficult/high-complexity, reflecting the need to gain a traffic-interception position.