What is the CVSS score of CVE-2026-52656?

CVE-2026-52656 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of SJCAM SJ4000-Air are affected by CVE-2026-52656?

SJCAM SJ4000-Air action cameras and compatible whitelabel devices (firmware V1.4C and earlier) contain a critical arbitrary code execution vulnerability triggered by maliciously crafted firmware…

How to fix or mitigate CVE-2026-52656?

Within 24 hours, conduct an inventory audit of all SJCAM SJ4000-Air and whitelabel cameras to identify firmware versions V1.4C and earlier, and document their network configuration and update mechanisms. Within 7 days, implement network segmentation to isolate affected cameras from production systems and critical infrastructure, disable any remote or automatic firmware update capabilities if the camera interface permits, and establish a mandatory verification process for any firmware updates (e.g., checksum validation against official vendor sources). Within 30 days, monitor SJCAM's security advisories and Allwinner vendor resources for a patched firmware release; upon availability, execute a phased rollout of the patched firmware beginning with non-critical units.

SJCAM SJ4000-Air CVE-2026-52656

EUVD-2026-46142 CRITICAL

Code Injection (CWE-94)

2026-07-20 mitre

GHSA-3q4c-68fc-p58j

RCE Code Injection N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

FEX-file processing implies local delivery (AV:L) and a user-initiated update/flash (UI:R); no auth gate is described (PR:N), and successful code injection fully compromises the device (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 16:26 vuln.today

CVSS changed

Jul 21, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 20, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 20, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file

AnalysisAI

Arbitrary code execution in SJCAM SJ4000-Air action cameras (firmware V1.4C and earlier), and unbranded whitelabel devices built on the same v1.4C firmware, is possible via a maliciously crafted FEX file - the Allwinner firmware/partition configuration format used by these AllwinnerTech-based devices. The flaw is classified as code injection (CWE-94) with a supplied CVSS of 9.8; no public exploit or CISA KEV listing exists at time of analysis, though a detailed reverse-engineering writeup of the device firmware is publicly referenced. The AV:N network rating in the supplied vector is inconsistent with the description's file-processing mechanism and warrants verification.

Technical ContextAI

The affected devices are SJCAM action cameras built on AllwinnerTech SoC platforms running proprietary Android-based firmware. 'FEX' refers to Allwinner's firmware image/script format (e.g. sys_config.fex / boot resource images) that is parsed and processed by the bootloader and firmware-update routines. CWE-94 (Improper Control of Generation of Code / Code Injection) indicates that content within a crafted FEX file is interpreted as executable logic rather than treated as inert data, allowing attacker-controlled code paths to run on the device. The public reference (keowu.re Lelouch reverse-engineering post) documents the proprietary Android-based firmware internals and the effort to build an open-source custom firmware, providing background on how these images are structured and loaded.

RemediationAI

No vendor-released patch version is identified at time of analysis; the SJCAM vendor site (https://sjcam.com) should be monitored for firmware updates superseding V1.4C. As compensating controls, treat firmware and FEX/update images as untrusted: do not load firmware or configuration files from unverified sources or found media, disable or physically restrict SD-card/USB-based firmware-update paths where the device supports it, and only apply firmware obtained directly from the vendor over a verified channel. Because the device is a consumer action camera, isolate it from sensitive networks and avoid connecting it to untrusted companion apps or hosts. The trade-off of disabling update paths is that legitimate firmware fixes must then be applied manually and deliberately. Reference NVD detail at https://nvd.nist.gov/vuln/detail/CVE-2026-52656 for updates.