EUVD-2026-75051
GHSA-x6jf-xjpf-22fw
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network passive eavesdropping with no privileges or interaction needed; confidentiality-only impact with no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless range may capture and reconstruct the live video stream without transport encryption.
AnalysisAI
Unencrypted UDP video transmission in the C6 Ear Camera and its companion EarVision Android application (version 1.3.1 / firmware 1.3.1_Code 132) exposes live ear-canal video streams to passive eavesdropping by any attacker within local wireless range. The camera broadcasts JPEG and WEBP frames over plaintext UDP with no transport-layer security, and the Android application's manifest explicitly permits cleartext traffic, removing any client-side enforcement barrier. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be within local wireless range and on the same network segment as the C6 Ear Camera and Android device during an active video streaming session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 with AV:A reflects the physical proximity constraint that significantly limits opportunistic mass exploitation; an attacker must be on the same local wireless segment as the target device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified in the available data at time of analysis; the CISA CSAF advisory (va-26-251-01) should be monitored for updated guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit organizational deployment of C6 Ear Camera devices and confirm whether patient video has been transmitted over clinic or shared networks; immediately disable WiFi connectivity on affected devices or remove from clinical networks entirely. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hardcoded or algorithmically derivable Wi-Fi credentials in the Softish C6 Ear Camera (firmware 1.3.1_Code 132) and comp
Unauthenticated firmware injection in Softish EarVision Android Application 1.3.1 paired with the C6 Ear Camera 1.3.1_Co
Device impersonation via unauthenticated camera spoofing in Softish's EarVision ecosystem exposes Android app users to m
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today