Girafit Camera App EUVD-2026-107366

Exploitation requires one of two concrete paths: (1) obtaining and decompiling the Girafit camera app binary (Android or iOS, v1.9.1 or earlier) to read the hardcoded TURN username/session token, or (2) being positioned to intercept the UNENCRYPTED (cleartext) STUN/TURN authentication traffic exchanged specifically during live-view registration. No authentication is required (PR:N) and it works against default configurations. The significant limiting factor is impact, not access: the leaked credential is a shared static TURN username/session token common to all installs and tied to no user or device, so on its own it enables only tracking/fingerprinting; impersonation or further exploitation is explicitly gated on also possessing the separate TURN relay password, which this vulnerability does not disclose.

This is a moderate-severity information-disclosure issue, not a top-tier priority despite being remotely reachable. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) shows an unauthenticated, low-complexity, network-reachable flaw, but the impact is deliberately scoped to low confidentiality only (VC:L, with VI:N/VA:N and no subsequent-system impact), yielding a 6.9 medium score. What is actually disclosed is a STATIC, SHARED TURN relay username and session token that is identical across all installs and tied to no user or device - so by itself it leaks no personal or device-specific data and grants no direct access. Publicly available exploit code exists (POC=YES via VulnCheck/the referenced write-up), which raises practical reachability, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation - treat this as publicly demonstrated but not confirmed exploited in the wild. A key limiting signal: the description itself says meaningful abuse (impersonation, further exploitation) only materializes 'if combined with the TURN relay password,' which is NOT part of this disclosure - so the standalone real-world risk is lower than the network vector alone suggests. No conflicting CVSS-vs-description signals on attack vector were found; both agree on remote cleartext interception / app decompilation.

An attacker either decompiles the Girafit Android/iOS app (v1.9.1 or earlier) or passively intercepts the unencrypted STUN/TURN traffic exchanged during live-view registration, and reads out the hardcoded, shared TURN relay username and session token. Because these values are identical across every installation, the attacker can reuse them to fingerprint/track Girafit traffic or set up for impersonation - though full impersonation or further exploitation additionally requires the separate TURN relay password. A public proof-of-concept / technical write-up for this extraction already exists.