EUVD-2026-76128
GHSA-988q-pfqj-3hc5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconGain physical access to camera
-
DeliveryConnect to UART serial header
-
ExploitInterrupt boot sequence
-
InstallEnter hard-coded bootloader credential
-
C2Authenticate to privileged bootloader
-
ExecuteFlash modified firmware or alter configuration
-
ImpactPersistent device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires physical, hands-on access to the ANJIA AJL33PC0801 device to connect to the bootloader interface (typically a UART/serial header on the PCB). The attacker must interrupt the boot sequence during device power-on/restart. No network access, no prior authentication, and no special software tools beyond a serial adapter and terminal emulator are required once physical access is achieved. The primary limiting factor is the physical access requirement (CVSS AV:P): remote or network-based exploitation is not possible. The vulnerability is present regardless of network configuration, firmware version specifics (within the confirmed scope), or operational mode of the camera. |
| Impact | The CVSS 4.0 score of 7.0 with AV:P correctly reflects the mandatory physical access prerequisite, which is the primary risk limiter here. Remote exploitation is not possible; an attacker must have direct, hands-on access to the physical device - significantly constraining opportunistic or mass exploitation. Despite the physical vector, the downstream impact metrics are VC:H/VI:H/VA:H, reflecting that once physical access is achieved, device compromise is total. The ICS-CERT context elevates concern: IP cameras in OT/industrial deployments may be co-located with sensitive network segments, making physical access during a site intrusion or insider-threat scenario higher-stakes than for a consumer device. No EPSS data was provided, and the vulnerability is not in CISA KEV, consistent with the physical-access constraint limiting widespread automated exploitation. The 'Authentication Bypass' tag in the input is a loose fit - this is a hard-coded credential issue (CWE-798), not a protocol-level authentication bypass. Data quality is adequate; the CISA advisory is the authoritative source, but no patched firmware version is specified in available data. |
| Exploit ScenarioDerived | An attacker gains physical access to an ANJIA AJL33PC0801 camera - for example, during an after-hours intrusion to a facility or as a rogue insider during maintenance - connects to the exposed UART serial header on the PCB, interrupts the boot sequence, and enters the hard-coded bootloader credential. With bootloader control, the attacker flashes modified firmware containing a backdoor or persistent implant, then reboots the device, which continues to appear operational while under adversary control. No public exploit code has been identified; the attack is straightforward given knowledge of the credential. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 11, 2026
Hard-coded bootloader credentials in the ANJIA AJL33PC0801 IP camera allow any attacker with physical device access to authenticate to the bootloader without knowing a legitimate password. Successful exploitation grants full control over firmware loading and system configuration, enabling persistent device compromise, implant installation, or complete operational disruption. CISA issued ICS advisory ICSA-26-251-01 for this vulnerability; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
No vendor-released patched firmware version has been identified in available data; consult the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-251-01 for vendor guidance and any available firmware update. As a compensating control, restrict physical access to all AJL33PC0801 units by securing camera mounting locations, server rooms, and cable runs against unauthorized physical contact - this directly eliminates the attack vector given AV:P. Where physical access cannot be fully controlled (e.g., externally mounted cameras), tamper-evident sealing and physical intrusion detection on the device enclosure add a detection layer. Network-segment isolation of camera VLANs limits post-compromise lateral movement if a device is successfully implanted. Operator-level firmware integrity verification (comparing known-good hashes) can detect unauthorized firmware modification after the fact.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The AJL33PC0801 is an embedded IP camera manufactured by ANJIA, likely based on a common ARM/MIPS SoC platform with a bootloader (e.g., U-Boot or vendor-customized equivalent) managing firmware load sequence and early system initialization. CWE-798 (Use of Hard-coded Credentials) describes the root cause: the bootloader contains a credential embedded at compile time that cannot be rotated or overridden by operators. Access to the bootloader console is typically exposed via a UART/serial header on the PCB. Because the credential is uniform across all units of the same firmware build, discovery of the credential from one device compromises all devices sharing that firmware. The CISA ICS-CERT advisory (ICSA-26-251-01) classifies this as an OT/ICS asset vulnerability, indicating deployment in security, industrial, or critical infrastructure camera networks.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Physical access is mandatory (AV:P), no privileges or interaction needed; full CIA impact on the device once bootloader access is achieved with the hard-coded credential.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
DescriptionCVE.org
The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially resulting in complete device compromise.
Executive ViewAI
The ANJIA AJL33PC0801 IP camera contains hard-coded bootloader credentials that allow any attacker with physical access to load malicious firmware and establish persistent control over the device. While requiring hands-on device access rather than network exploitation, successful compromise can undermine surveillance monitoring, create persistent network footholds, and potentially be weaponized to access adjacent systems if cameras connect to enterprise networks. CISA advisory ICSA-26-251-01 confirms this affects security infrastructure integrity.
Enforce physical security perimeter controls around all camera installations (locked enclosures, badge access, visitor logs); segment camera networks to isolated VLANs with network access control lists that restrict traffic to logging servers only; deploy network-based intrusion detection tuned to detect unusual camera behavior (unexpected connections, firmware update attempts, configuration changes); audit and disable all unnecessary network services on the devices; maintain regular backups of legitimate device firmware for comparison against potential compromises; monitor CISA advisories for additional guidance on ANJIA products.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB