AJA HELO Plus CVE-2026-47096

Requires that the HELO Plus device be operating with its authentication DISABLED - without this, the unauthenticated /config?action=set write is not reachable, making this the primary limiting factor. The attacker needs network access to the device's web configuration API and injects JavaScript into the eParamID_SystemName field. Execution further requires an administrator to subsequently open the web management interface (UI:P/UI:R - passive interaction), at which point the stored payload fires. Affected: AJA HELO Plus firmware before 2.1.7; fixed in 2.1.7.

This is a genuine but conditionally-gated stored XSS, not a drop-everything priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, base 5.3) is internally consistent with the description: network-reachable, no attacker privileges, but passive user interaction (UI:P) required and impact confined to subsequent-system confidentiality/integrity (SC:L/SI:L) - the injected script runs in the admin's browser, not on the device OS. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' despite the credible attack narrative. The single most important limiting signal is buried in the description, not the vector: exploitation only works 'when device authentication is disabled,' which the AV:N/PR:N framing alone does not convey. Combined with the niche pro-AV encoder footprint and required admin interaction, real-world risk is low-to-moderate and situational rather than broad. No key signals directly conflict, but note the vector's PR:N/AC:L understates the practical precondition (auth must be off) - defenders should treat the auth-disabled deployment mode, not raw CVSS, as the true risk gate.

On a HELO Plus encoder deployed with device authentication turned off (a supported mode), a remote unauthenticated attacker sends a POST to /config?action=set writing a malicious JavaScript payload into eParamID_SystemName. The next time an administrator opens the web management interface, the stored script executes in their browser, exfiltrating web-UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials or hijacking the authenticated session. No public exploit code is identified in the provided data, though VulnCheck published a technical advisory.