Which versions of JAIOTlink C492A-W6 are affected by EUVD-2026-41049?

JAIOTlink C492A-W6 IP cameras (firmware 4.8.30.57701411) contain a critical default-credential authentication bypass enabling unrestricted unauthenticated access to video feeds, snapshots, and…

Is there a public PoC exploit available for EUVD-2026-41049?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41049. Prioritise patching immediately. EPSS: 1.7%.

How to fix or mitigate EUVD-2026-41049?

Within 24 hours: Conduct inventory of all JAIOTlink C492A-W6 devices and confirm affected firmware versions; note that publicly available exploit code exists. Within 7 days: Isolate affected cameras on a segregated VLAN, implement firewall rules restricting HTTP/HTTPS access to authorized management IPs only, and deploy IDS/IPS detection rules for exploit attempts. Within 30 days: Evaluate equipment replacement with secure alternatives and implement continuous monitoring for suspicious camera access patterns and data exfiltration.

JAIOTlink C492A-W6 EUVD-2026-41049

Q: What is the CVSS score of EUVD-2026-41049?

EUVD-2026-41049 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.7%.

| CVE-2026-58453 CRITICAL

Use of Default Credentials (CWE-1392)

2026-07-01 VulnCheck

GHSA-fg9v-4hw2-f9w8

Command Injection Authentication Bypass C492A W6 Wi Fi Ip Camera

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Description says 'network-adjacent' so AV:A (conflicts with input AV:N); empty default password means PR:N and AC:L, with full C/I/A loss over the device.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:50 vuln.today

DescriptionCVE.org

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to gain unauthorized access by using the default admin username with an empty password accepted by the anyka_ipc HTTP service on port 80. Attackers can authenticate with these hardcoded credentials to access camera snapshots, video streams, network configuration, and factory-level API endpoints including the SetMAC command injection surface.

AnalysisAI

Default-credential authentication bypass in JAIOTlink C492A-W6 Wi-Fi IP cameras (firmware 4.8.30.57701411) lets attackers log in to the anyka_ipc HTTP service on port 80 using the built-in admin username with an empty password, granting full access to snapshots, live video, network configuration, and factory-level API endpoints. Because the same interface exposes a SetMAC command-injection surface, this trivial access can be pivoted toward device-level code execution. Publicly available exploit code exists (published by VulnCheck), though this CVE is not listed in CISA KEV and no active exploitation is confirmed.

Technical ContextAI

The affected component is anyka_ipc, the HTTP/RTSP camera application shipped on Anyka-SoC-based IP cameras (a common ODM platform rebranded by many low-cost vendors, here JAIOTlink). The root cause is CWE-1392 (Use of Default Credentials): the firmware ships an admin account whose password is empty and accepted as valid by the port-80 web service, so no credential provisioning or forced password change gates the management interface. Once authenticated, the same service exposes factory/diagnostic API endpoints, including a SetMAC handler that the reporter identifies as a command-injection surface - meaning the weak-authentication flaw sits directly in front of a more severe RCE-class primitive on the embedded Linux camera.

RemediationAI

No vendor-released patch identified at time of analysis; JAIOTlink has no published fixed firmware version in the available data. Because the flaw is default/empty credentials, the primary compensating control is to immediately set a strong, unique admin password on the port-80 anyka_ipc web interface if the firmware permits it - if it does not accept a non-empty password or reverts on reboot, treat the device as unfixable in place. Network-level controls are essential: place the camera on an isolated VLAN or dedicated IoT network segment, block inbound access to TCP port 80 (and RTSP) from untrusted networks and the internet, and restrict management access to a single trusted host or jump box; the trade-off is loss of remote viewing convenience and any cloud/app features that depend on the exposed service. Given the SetMAC command-injection exposure behind this authentication, monitor for or block access to the factory API endpoints, and consider replacing the device if it must remain internet-reachable. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/jaiotlink-c492a-w6-hard-coded-credentials-via-anyka-ipc) and the technical write-up (https://github.com/rwprimitives/jaiotlink-c492a-wifi-camera/blob/main/writeups/02-default-http-credentials.md) for details.