EUVD-2026-109607
GHSA-4946-g74f-xm3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent/local network position
-
ExploitInteract with wpa_supplicantX.conf WiFi config handling
-
ImpactTrigger improper initialization, limited integrity impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Proper initialization
|
| Exploitation Conditions | Requires an attacker positioned on the same local/WiFi network as the Yoosee GM8135S Camera (firmware 21.00.01.36); remote Internet exploitation is not in scope (AV:A). Exploitation targets the WiFi Configuration component's processing of the wpa_supplicantX.conf file and leads to improper initialization (CWE-665). Limiting factors: high attack complexity (AC:H) and the vendor's own statement that exploitability is difficult; no authentication is required (PR:N) and no user interaction (UI:N). The specific mechanism that triggers the improper initialization is not described in the available sources, and no non-default configuration prerequisite is stated. No fixed version is listed and the vendor did not respond to the disclosure. |
| Impact | This is a low-priority issue on every available signal. The CVSS 4.0 vector (AV:A/AC:H/AT:N/PR:N/UI:N) scores just 2.3, driven by adjacent-network-only reach (AV:A), high attack complexity (AC:H), and an impact limited to low integrity (VI:L) with no confidentiality or availability effect (VC:N/VA:N). The vendor-stated 'exploitability is difficult' aligns with AC:H. There is no EPSS score in the input and the CVE is not on CISA KEV, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'monitor', the lowest-urgency tier, which is consistent with the low CVSS and absence of KEV. A public PoC reference exists but is not verified as working exploit code, so it should not be read as confirmation of practical exploitability. One conflict worth noting: the 'Information Disclosure' tag implies confidentiality loss, yet the CVSS vector sets VC:N and assigns impact only to integrity (VI:L) - the tag and the vector disagree on impact type, so verify what the flaw actually exposes. Net assessment: a genuinely low real-world risk, not a high-CVSS-but-overrated case; the low score reflects low real severity. |
| Exploit ScenarioDerived | An attacker already on the same local/WiFi network as the camera interacts with the WiFi Configuration component's handling of wpa_supplicantX.conf to trigger improper initialization, yielding a limited integrity effect. A public PoC reference is published but is not verified as working exploit code, and the vendor describes exploitability as difficult, so a reliable real-world attack is not demonstrated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Improper initialization in the WiFi Configuration component of the Yoosee GM8135S Camera (firmware 21.00.01.36) lets an attacker positioned on the same local or WiFi network manipulate the wpa_supplicantX.conf file, with the impact assessed as limited to integrity (no confidentiality or availability loss). Exploitation is rated as high complexity and difficult by both the CVSS vectors and the vendor, no authentication or user interaction is required, and the mechanism that actually triggers the improper initialization is not described in the available sources. A public writeup reference exists (not verified as working exploit code), the EPSS-style signal and vuln.today decision label are both low ('monitor'), and this is a low-priority issue on every available signal; the vendor was contacted but did not respond, and no fixed version is listed.
RemediationAI
No vendor-released patch or fixed firmware version is identified at time of analysis: the vendor did not respond to the disclosure and none of the references (VulDB VDB-426183, its CTI page, the CVE record, or the public writeup) list a remedy, so there is no exact upgrade version to cite. Because the attack path is confined to the local network (AV:A) and centers on the WiFi Configuration component's handling of wpa_supplicantX.conf, the practical options are to keep the camera's WiFi/LAN segment isolated from untrusted clients (separate SSID/VLAN with client isolation disabled traffic between guests and IoT devices) and to restrict which hosts can reach the camera's management and WiFi configuration interfaces - accepting that this narrows exposure rather than fixing the flawed initialization. Owners should track the VulDB entry (https://vuldb.com/vuln/426183) for a firmware update and, given the high complexity and limited integrity-only impact, treat this as a low-priority monitoring item rather than an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected target is a Yoosee camera built on the GM8135S platform, firmware 21.00.01.36, per the CPE entry for the product line. The flaw is classified as CWE-665 (Improper Initialization) and maps to the device's WiFi Configuration handling, specifically processing of the wpa_supplicantX.conf file - the wpa_supplicant configuration file that stores network credentials and interface settings on embedded Linux devices. The CVSS:4.0 vector AV:A/AC:H/AT:N/PR:N/UI:N with only VI:L and no VC/VA or subsequent-system impact describes an adjacent-network, high-complexity attack requiring no privileges or user interaction, with a limited integrity effect; the assessed CVSS:3.1 equivalent (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) agrees. Notably, the supplied data does not explain what the improper initialization consists of or how an attacker reaches it through the configuration file, so the precise trigger mechanism, and whether any non-default configuration is needed, is not described in the available sources. The CPE string is version-wildcarded, so the confirmed affected release is the one named in the report (21.00.01.36) and other versions are unverified.
Know when Gm8135S Camera gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Adjacent-network only (AV:A) with vendor-confirmed difficult, high-complexity trigger (AC:H); no auth or interaction (PR:N/UI:N); impact limited to low integrity (I:L), no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB