EUVD-2026-75056
GHSA-9c93-gw6q-j6xv
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent wireless vector required; device spoofing elevates complexity to AC:H; single user interaction needed (UI:R); firmware implant on separate hardware component changes scope (S:C).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel.
AnalysisAI
Unauthenticated firmware injection in Softish EarVision Android Application 1.3.1 paired with the C6 Ear Camera 1.3.1_Code 132 allows an adjacent attacker to deliver arbitrary, unsigned firmware to the physical ear camera device. By spoofing the C6 Ear Camera's wireless identity and eliciting a single user confirmation, the attacker triggers the application to transmit firmware over an update channel that performs neither endpoint authentication nor cryptographic signature verification (CWE-306). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be within adjacent wireless range (Bluetooth or Wi-Fi Direct proximity) of a victim who has the EarVision Android application running and paired to a C6 Ear Camera. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 4.0 score of 8.5 (AV:A/AC:L/AT:N/PR:N/UI:A) correctly reflects the adjacent-network constraint and the single-interaction requirement, though the AT:N metric may understate practical attacker effort since device identity spoofing - while achievable with commodity tools - is a non-trivial prerequisite not captured by AC:L alone in CVSS 4.0 semantics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-251-01.json for the most current vendor guidance and any patched release information. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Softish EarVision C6 version 1.3.1_Code 132 devices and paired Android application v1.3.1 installations; disable automatic firmware updates and restrict devices to isolated Wi-Fi networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hardcoded or algorithmically derivable Wi-Fi credentials in the Softish C6 Ear Camera (firmware 1.3.1_Code 132) and comp
Device impersonation via unauthenticated camera spoofing in Softish's EarVision ecosystem exposes Android app users to m
Unencrypted UDP video transmission in the C6 Ear Camera and its companion EarVision Android application (version 1.3.1 /
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today