AJA HELO Plus EUVD-2026-89967

Exploitation requires network reachability to the affected AJA HELO Plus device's unauthenticated diagnostics endpoint (any device running firmware before 2.1.7). No authentication, user interaction, or non-default configuration is needed - the diagnostics endpoint is unauthenticated and the AES passphrase is static and shared across all devices, recoverable from the publicly available firmware image. The primary limiting factor is reachability: the attacker must be able to reach the device's management/diagnostics interface (typically on an internal or AV production network), and must perform a one-time firmware reverse-engineering step to recover the passphrase, after which any affected device can be targeted.

This is a genuine, well-substantiated information-disclosure issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) is internally consistent with the description: an unauthenticated network attacker retrieves diagnostics bundles from an open endpoint and decrypts them using a static AES passphrase (CWE-321) extractable from the publicly downloadable firmware image. The 8.7 score is driven entirely by high confidentiality impact with zero integrity/availability impact (VI:N/VA:N), which correctly reflects a read-only data exposure. No EPSS score, CISA KEV listing, or public exploit code was provided in the input, so this is 'no public exploit identified at time of analysis' - but the low technical barrier (firmware is public, passphrase is shared across all devices, endpoint is unauthenticated) means a working exploit is trivial to develop once the passphrase is reversed. The main factor tempering real-world risk is the narrow deployment footprint of the affected product (a professional streaming/encoding appliance), not any technical difficulty. Reported by VulnCheck, a credible source, and a vendor patch (firmware 2.1.7) is confirmed available.

An attacker downloads the publicly available AJA HELO Plus firmware image, reverse engineers it to recover the obfuscated static AES passphrase shared across all devices, then queries the unauthenticated diagnostics endpoint on an internet-reachable or network-adjacent HELO Plus unit to pull an encrypted diagnostics bundle. Using the recovered passphrase, they decrypt the bundle offline to expose highly sensitive server/configuration information. No public exploit code is identified at time of analysis, but the technique is low-complexity and fully documented in the VulnCheck advisory.