Which versions of Digital Photo Frame Gh Wdf10A are affected by EUVD-2026-16096?

CVE-2026-33201 presents moderate security risk rated CVSS 7.0. Exploitation could compromise the security of affected deployments.

How to fix or mitigate EUVD-2026-16096?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Digital Photo Frame Gh Wdf10A EUVD-2026-16096

Q: What is the CVSS score of EUVD-2026-16096?

EUVD-2026-16096 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-33201 HIGH

Active Debug Code (CWE-489)

2026-03-26 jpcert

RCE Digital Photo Frame Gh Wdf10A

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 04:30 euvd

EUVD-2026-16096

Analysis Generated

Mar 26, 2026 - 04:30 vuln.today

CVE Published

Mar 26, 2026 - 04:18 nvd

HIGH 7.0

DescriptionCVE.org

Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., LTD. contains an active debug code vulnerability. If this vulnerability is exploited, files or configurations on the affected device may be read or written, or arbitrary files may be executed with root privileges.

AnalysisAI

The GREEN HOUSE CO., LTD. Digital Photo Frame GH-WDF10A contains active debug code that allows unauthenticated local attackers to read or write arbitrary files and execute commands with root privileges. This vulnerability affects all versions of the GH-WDF10A model and represents a critical local privilege escalation risk for any user with physical or network access to the device. While the CVSS score of 6.8 reflects medium severity due to the physical access requirement, the ability to achieve root code execution makes this a significant concern for device owners and enterprise deployments.

Technical ContextAI

The vulnerability stems from CWE-489 (Active Debug Code), a class of weakness where diagnostic or debugging functionality is left enabled in production firmware. In the GH-WDF10A digital photo frame (confirmed via CPE cpe:2.3:a:green_house_co.,_ltd.:digital_photo_frame_gh-wdf10a:*:*:*:*:*:*:*:*), this debug code likely exposes administrative interfaces or shell access that should have been removed before release. The device's embedded Linux-based operating system running with root-level processes becomes exploitable when debug ports, shells, or command interfaces remain accessible without proper authentication. This is a classic example of insecure defaults where development tooling was not stripped from production firmware, a common oversight in IoT and embedded device manufacturing.

RemediationAI

Contact GREEN HOUSE CO., LTD. immediately to obtain a patched firmware version for the GH-WDF10A, referencing the vendor advisory at https://www.green-house.co.jp/note/info_gh-wdf10a/. Until a firmware update is available and deployed, implement the following interim controls: restrict network access to the device to trusted internal networks only (disable WAN-facing connectivity if possible), disable any debug ports or interfaces accessible via SSH, serial console, or telnet, and ensure physical security controls prevent unauthorized local access to the device. If the device is deployed in a corporate environment, segment it on an isolated VLAN and monitor for suspicious access patterns. Do not expose the device to untrusted networks or public internet connectivity until an official patch is applied.