Yoosee GM8135S Camera CVE-2026-116116

Exploitation requires local access to the Yoosee GM8135S Camera (CVSS AV:L - no network path) combined with high existing privileges on the device (PR:H), meaning the attacker must already be operating in a privileged context before abusing the Secure Boot signature-verification weakness. The specific feature affected is the device's Secure Boot cryptographic signature verification, which the exploit causes to improperly accept a manipulated image (CWE-347). Limiting factors for defenders: there is NO remote or unauthenticated path, no user-interaction-driven mass vector, and the capability is primarily useful for firmware tampering/persistence rather than initial access; the exact trigger mechanism is not described in the available sources.

This is a genuinely high-severity flaw (CVSS 4.0 base 8.4) but with meaningful real-world constraints that lower its operational urgency. The CVSS 4.0 vector is decisive on mechanism: AV:L means the attack must be approached locally (no network reach), and PR:H means the attacker already needs high privileges on the device before the flaw is useful. Those two factors together make this a post-compromise / supply-chain-tampering capability rather than a remotely-wormable issue. Against that, the impact metrics are maximal (VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H), which fits a Secure Boot signature-verification bypass (CWE-347): defeating boot-chain trust undermines the integrity of the entire device. On the exploitation side the signals are modest and partly conflicting: the CVSS exploit-maturity is E:P (proof-of-concept), the multi-source data marks the PoC as 'reference only, not verified as working exploit code', there is NO CISA KEV listing, and no EPSS score was provided. The vendor was contacted but did not respond, so no fix is available. Net: a real priority for anyone deploying these specific cameras in sensitive settings, but the local-access + high-privilege precondition means it is not a mass-exploitation / drive-by threat. The vuln.today Decision label is 'this_week', consistent with elevated-but-not-emergency handling.

An attacker with local, privileged access to a Yoosee GM8135S camera (for example via physical access, a service account, or a prior compromise) manipulates the device so that the Secure Boot stage improperly validates a cryptographic signature, allowing an unsigned or tampered firmware/boot image to be accepted. A public PoC reference exists (akosibrylle.me write-up), though it is not verified as working exploit code, so weaponization effort may still be required. Because the attack vector is local and requires high privileges, this is realistic as a persistence/tampering step rather than an initial remote intrusion.