Which versions of GALAYOU Y4 are affected by EUVD-2026-36671?

GALAYOU Y4 v1.0.0 devices connected to internal networks are vulnerable to remote compromise with publicly available exploit code and no vendor patch forthcoming.

How to fix or mitigate EUVD-2026-36671?

Within 24 hours: Complete asset inventory of all GALAYOU Y4 v1.0.0 deployments and map network exposure; segregate vulnerable devices to isolated VLANs or dedicated network segments. Within 7 days: Deploy network-based detection rules for buffer overflow exploitation attempts; implement access control lists restricting inbound and outbound traffic to/from affected devices. Within 30 days: Execute remediation-upgrade to patched device models or decommission; if retention required, maintain strict network segregation and enhanced monitoring as permanent controls.

GALAYOU Y4 EUVD-2026-36671

Q: What is the CVSS score of EUVD-2026-36671?

EUVD-2026-36671 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-12192 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-14 VulDB

GHSA-rm6x-6fv3-45m8

Buffer Overflow Y4

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Adjacent-network web request, no auth or user interaction, low complexity, and a buffer overflow in the device's own web server yields full C/I/A on the camera with no scope change.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 15, 2026 - 00:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 15, 2026 - 00:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 15, 2026 - 00:22 vuln.today

cvss_changed

CVSS changed

Jun 15, 2026 - 00:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jun 14, 2026 - 23:58 vuln.today

DescriptionCVE.org

A vulnerability was determined in GALAYOU Y4 1.0.0. Impacted is an unknown function of the component Web Server. This manipulation causes buffer overflow. The attack is only possible within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Buffer overflow in the web server component of GALAYOU Y4 version 1.0.0 allows adjacent-network attackers to compromise the device's confidentiality, integrity, and availability without authentication. Publicly available exploit code exists per VulDB disclosure, though the vendor was contacted and did not respond, leaving the issue unpatched. EPSS data was not provided and the flaw is not listed in CISA KEV, but the public PoC combined with vendor silence elevates practical risk for any deployment exposed on shared LAN/Wi-Fi segments.

Technical ContextAI

GALAYOU Y4 1.0.0 is an IP/network camera (consumer surveillance device) that exposes an embedded HTTP web server for configuration and viewing. The vulnerability falls under CWE-120 (Classic Buffer Overflow / Copy without Checking Size of Input), a memory-safety class typical of C/C++ embedded firmware where an input field, header, or parameter is copied into a fixed-size stack or heap buffer without bounds enforcement. Because such cameras commonly run a minimal Linux/RTOS stack without modern exploit mitigations (ASLR, stack canaries, NX consistently enforced), CWE-120 in the HTTP parsing path is frequently a direct path to arbitrary code execution on the device. The single CPE cpe:2.3:a:galayou:y4:*:*:*:*:*:*:*:* indicates the entire Y4 product line is in scope rather than a specific firmware build.

RemediationAI

No vendor-released patch identified at time of analysis - GALAYOU was contacted and did not respond, so defenders must rely on compensating controls. Place affected Y4 cameras on an isolated VLAN or dedicated IoT SSID that no untrusted client (guest devices, BYOD, tenant networks) can reach, since AV:A means an attacker must share the broadcast domain; this is the single most effective mitigation but adds network management overhead. Restrict inbound access to the camera's HTTP/web-server port at the local gateway or host firewall so only the management workstation or NVR can reach it, accepting that mobile app access from arbitrary client devices on the LAN will break. Disable remote/cloud features and UPnP on the device and on the router to prevent inadvertent NAT exposure. If the camera is non-essential, power it down or replace it with a supported model - given the vendor's non-response, future CVEs in the same product are likely to follow the same path. Track VulDB entry https://vuldb.com/vuln/370838 for any belated vendor update.