Gm8135S Camera
Monthly
Improper Secure Boot signature verification in Yoosee GM8135S Camera 21.00.01.36 lets a local attacker who already holds high privileges get a manipulated firmware image accepted (CWE-347), undermining firmware trust and enabling tampering or persistence. The CVSS 4.0 base score is 8.4, but the attack path is local and requires existing privileged access, with no remote or unauthenticated vector described; the exact trigger is not detailed in the available sources. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV entry confirms active exploitation; the disclosure is prioritized this_week.
Improper initialization in the WiFi Configuration component of the Yoosee GM8135S Camera (firmware 21.00.01.36) lets an attacker positioned on the same local or WiFi network manipulate the wpa_supplicantX.conf file, with the impact assessed as limited to integrity (no confidentiality or availability loss). Exploitation is rated as high complexity and difficult by both the CVSS vectors and the vendor, no authentication or user interaction is required, and the mechanism that actually triggers the improper initialization is not described in the available sources. A public writeup reference exists (not verified as working exploit code), the EPSS-style signal and vuln.today decision label are both low ('monitor'), and this is a low-priority issue on every available signal; the vendor was contacted but did not respond, and no fixed version is listed.
Cleartext transmission of the Live UDP H.264 video stream in Yoosee GM8135S camera firmware 21.00.01.36 lets anyone positioned on the network path observe the endpoint at /npc/npc and read the unencrypted video feed, with confidentiality impact only (no integrity or availability effect). The camera requires no authentication (PR:N) and no user interaction (UI:N), but exploitation is rated high-complexity because it depends on first obtaining an on-path or shared-network vantage point (same LAN/Wi-Fi segment, upstream router, or other interception position) rather than simply sending a crafted request. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is associated with this CVE, and the vendor was contacted early but did not respond, so no patched firmware version is confirmed.
Improper Secure Boot signature verification in Yoosee GM8135S Camera 21.00.01.36 lets a local attacker who already holds high privileges get a manipulated firmware image accepted (CWE-347), undermining firmware trust and enabling tampering or persistence. The CVSS 4.0 base score is 8.4, but the attack path is local and requires existing privileged access, with no remote or unauthenticated vector described; the exact trigger is not detailed in the available sources. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV entry confirms active exploitation; the disclosure is prioritized this_week.
Improper initialization in the WiFi Configuration component of the Yoosee GM8135S Camera (firmware 21.00.01.36) lets an attacker positioned on the same local or WiFi network manipulate the wpa_supplicantX.conf file, with the impact assessed as limited to integrity (no confidentiality or availability loss). Exploitation is rated as high complexity and difficult by both the CVSS vectors and the vendor, no authentication or user interaction is required, and the mechanism that actually triggers the improper initialization is not described in the available sources. A public writeup reference exists (not verified as working exploit code), the EPSS-style signal and vuln.today decision label are both low ('monitor'), and this is a low-priority issue on every available signal; the vendor was contacted but did not respond, and no fixed version is listed.
Cleartext transmission of the Live UDP H.264 video stream in Yoosee GM8135S camera firmware 21.00.01.36 lets anyone positioned on the network path observe the endpoint at /npc/npc and read the unencrypted video feed, with confidentiality impact only (no integrity or availability effect). The camera requires no authentication (PR:N) and no user interaction (UI:N), but exploitation is rated high-complexity because it depends on first obtaining an on-path or shared-network vantage point (same LAN/Wi-Fi segment, upstream router, or other interception position) rather than simply sending a crafted request. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is associated with this CVE, and the vendor was contacted early but did not respond, so no patched firmware version is confirmed.