EUVD-2026-36671
GHSA-rm6x-6fv3-45m8
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network web request, no auth or user interaction, low complexity, and a buffer overflow in the device's own web server yields full C/I/A on the camera with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in GALAYOU Y4 1.0.0. Impacted is an unknown function of the component Web Server. This manipulation causes buffer overflow. The attack is only possible within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Buffer overflow in the web server component of GALAYOU Y4 version 1.0.0 allows adjacent-network attackers to compromise the device's confidentiality, integrity, and availability without authentication. Publicly available exploit code exists per VulDB disclosure, though the vendor was contacted and did not respond, leaving the issue unpatched. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must have Layer-2/adjacent-network access to the camera (same LAN segment, same Wi-Fi SSID, or a routed network where broadcast/multicast reaches the device) - Internet-only attackers without prior LAN foothold cannot trigger this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H (base 7.4, threat E:P for proof-of-concept) indicates an adjacent-network, low-complexity, unauthenticated attack with full impact on the device - strong signals on paper. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has joined the same Wi-Fi network as the camera - for example a guest on a small-office network, a tenant in a shared residence, or a malicious device on an under-segmented IoT VLAN - sends a crafted HTTP request to the camera's web server that overflows a fixed-size buffer in the request parser. Using the publicly disclosed PoC, the attacker either crashes the device (loss of surveillance during a physical intrusion) or, with exploit refinement, achieves code execution on the embedded OS to view live video, pivot deeper into the LAN, or enroll the camera in a botnet. |
| Remediation | No vendor-released patch identified at time of analysis - GALAYOU was contacted and did not respond, so defenders must rely on compensating controls. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Complete asset inventory of all GALAYOU Y4 v1.0.0 deployments and map network exposure; segregate vulnerable devices to isolated VLANs or dedicated network segments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today