EUVD-2026-75053
GHSA-7c5f-9c8p-9qwg
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent network required; no privileges needed; user must initiate app session; high C/I impact from data interception and firmware manipulation; low availability impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation of device status responses, observation of application requests, and potential triggering of firmware-update behavior.
AnalysisAI
Device impersonation via unauthenticated camera spoofing in Softish's EarVision ecosystem exposes Android app users to man-in-the-middle attacks on adjacent networks. The C6 Ear Camera and its companion EarVision Android app (both at version 1.3.1) lack proper device authentication, allowing an adjacent network attacker to emulate the camera, intercept and manipulate device status responses, observe application traffic, and potentially trigger firmware-update behavior on the camera. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must be on the same adjacent wireless network segment as the victim (AV:A - same WiFi network or directly adjacent wireless range). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.4 (AV:A/AC:L/AT:N/PR:N/UI:A) reflects a meaningful but proximity-limited risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is confirmed in the available data - the CISA CSAF advisory should be monitored for patch availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all EarVision C6 cameras and associated Android applications in your environment, assess whether devices connect to networks that include sensitive systems or user data, and disable non-essential deployments immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hardcoded or algorithmically derivable Wi-Fi credentials in the Softish C6 Ear Camera (firmware 1.3.1_Code 132) and comp
Unauthenticated firmware injection in Softish EarVision Android Application 1.3.1 paired with the C6 Ear Camera 1.3.1_Co
Unencrypted UDP video transmission in the C6 Ear Camera and its companion EarVision Android application (version 1.3.1 /
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today