Search
Find a vulnerability
Search criteria
8 vulnerabilities by Yoosee
CVE-2026-116116 (GCVE-0-2026-116116)
Vulnerability from nvd – Published: 2026-10-26 04:00 – Updated: 2026-10-26 04:00
VLAI
EPSS
VEX
Title
Yoosee GM8135S Camera Secure Boot signature verification
Summary
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426184 | vdb-entry |
| https://vuldb.com/vuln/426184/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116116 | third-party-advisory |
| https://vuldb.com/submit/1004712 | third-party-advisory |
| https://akosibrylle.me/writeups/yoosee-cve | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yoosee | GM8135S Camera |
Affected:
21.00.01.36
cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:*"
],
"modules": [
"Secure Boot"
],
"product": "GM8135S Camera",
"vendor": "Yoosee",
"versions": [
{
"status": "affected",
"version": "21.00.01.36"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "brylleee (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:L/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T04:00:19.398Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426184 | Yoosee GM8135S Camera Secure Boot signature verification",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426184"
},
{
"name": "VDB-426184 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426184/cti"
},
{
"name": "CVE-2026-116116 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116116"
},
{
"name": "Submit #1004712 | Gwelltimes Technology Yoosee Smart Camera GM8135S 21.00.01.36 Insufficient Verification of Data Authenticity",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004712"
},
{
"tags": [
"exploit"
],
"url": "https://akosibrylle.me/writeups/yoosee-cve"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T09:43:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yoosee GM8135S Camera Secure Boot signature verification",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116116",
"datePublished": "2026-10-26T04:00:19.398Z",
"dateReserved": "2026-10-25T08:38:37.520Z",
"dateUpdated": "2026-10-26T04:00:19.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116115 (GCVE-0-2026-116115)
Vulnerability from nvd – Published: 2026-10-26 03:45 – Updated: 2026-10-26 03:45
VLAI
EPSS
VEX
Title
Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization
Summary
A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
- CWE-665 - Improper Initialization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426183 | vdb-entry |
| https://vuldb.com/vuln/426183/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116115 | third-party-advisory |
| https://vuldb.com/submit/1004711 | third-party-advisory |
| https://akosibrylle.me/writeups/yoosee-cve | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yoosee | GM8135S Camera |
Affected:
21.00.01.36
cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:*"
],
"modules": [
"WiFi Configuration"
],
"product": "GM8135S Camera",
"vendor": "Yoosee",
"versions": [
{
"status": "affected",
"version": "21.00.01.36"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "brylleee (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.8,
"vectorString": "AV:A/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T03:45:19.003Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426183 | Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426183"
},
{
"name": "VDB-426183 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426183/cti"
},
{
"name": "CVE-2026-116115 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116115"
},
{
"name": "Submit #1004711 | Gwelltimes Technology Yoosee Smart Camera GM8135S 21.00.01.36 Insecure Default Initialization of Resource",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004711"
},
{
"tags": [
"exploit"
],
"url": "https://akosibrylle.me/writeups/yoosee-cve"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T09:43:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116115",
"datePublished": "2026-10-26T03:45:19.003Z",
"dateReserved": "2026-10-25T08:38:05.356Z",
"dateUpdated": "2026-10-26T03:45:19.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116114 (GCVE-0-2026-116114)
Vulnerability from nvd – Published: 2026-10-26 03:30 – Updated: 2026-10-26 16:36
VLAI
EPSS
VEX
Title
Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission
Summary
A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:59 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426182 | vdb-entry |
| https://vuldb.com/vuln/426182/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116114 | third-party-advisory |
| https://vuldb.com/submit/1004708 | third-party-advisory |
| https://akosibrylle.me/writeups/yoosee-cve | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yoosee | GM8135S Camera |
Affected:
21.00.01.36
cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116114",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:59:47.582778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T16:36:08.843Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:*"
],
"modules": [
"Live UDP H.264 Video Stream Handler"
],
"product": "GM8135S Camera",
"vendor": "Yoosee",
"versions": [
{
"status": "affected",
"version": "21.00.01.36"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "brylleee (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack\u0027s complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-310",
"description": "Cryptographic Issues",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T03:30:21.410Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426182 | Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426182"
},
{
"name": "VDB-426182 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426182/cti"
},
{
"name": "CVE-2026-116114 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116114"
},
{
"name": "Submit #1004708 | Gwelltimes Technology Yoosee Smart Camera GM8135S 21.00.01.36 Cleartext Transmission of Sensitive Information",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004708"
},
{
"tags": [
"exploit"
],
"url": "https://akosibrylle.me/writeups/yoosee-cve"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T09:42:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116114",
"datePublished": "2026-10-26T03:30:21.410Z",
"dateReserved": "2026-10-25T08:37:06.644Z",
"dateUpdated": "2026-10-26T16:36:08.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-52085 (GCVE-0-2025-52085)
Vulnerability from nvd – Published: 2025-08-22 00:00 – Updated: 2025-08-26 14:07
VLAI
EPSS
VEX
Summary
An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner and version, current database user and schema, the current DBMS user privileges, and arbitrary data from any table.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-26 13:09 UTC
CWE
- n/a
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-52085",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-26T13:09:31.996089Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T14:07:31.385Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner and version, current database user and schema, the current DBMS user privileges, and arbitrary data from any table."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T17:55:37.780Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://yoosee.app"
},
{
"url": "https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52085",
"datePublished": "2025-08-22T00:00:00.000Z",
"dateReserved": "2025-06-16T00:00:00.000Z",
"dateUpdated": "2025-08-26T14:07:31.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-116116 (GCVE-0-2026-116116)
Vulnerability from cvelistv5 – Published: 2026-10-26 04:00 – Updated: 2026-10-26 04:00
VLAI
EPSS
VEX
Title
Yoosee GM8135S Camera Secure Boot signature verification
Summary
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426184 | vdb-entry |
| https://vuldb.com/vuln/426184/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116116 | third-party-advisory |
| https://vuldb.com/submit/1004712 | third-party-advisory |
| https://akosibrylle.me/writeups/yoosee-cve | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yoosee | GM8135S Camera |
Affected:
21.00.01.36
cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:*"
],
"modules": [
"Secure Boot"
],
"product": "GM8135S Camera",
"vendor": "Yoosee",
"versions": [
{
"status": "affected",
"version": "21.00.01.36"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "brylleee (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:L/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T04:00:19.398Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426184 | Yoosee GM8135S Camera Secure Boot signature verification",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426184"
},
{
"name": "VDB-426184 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426184/cti"
},
{
"name": "CVE-2026-116116 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116116"
},
{
"name": "Submit #1004712 | Gwelltimes Technology Yoosee Smart Camera GM8135S 21.00.01.36 Insufficient Verification of Data Authenticity",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004712"
},
{
"tags": [
"exploit"
],
"url": "https://akosibrylle.me/writeups/yoosee-cve"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T09:43:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yoosee GM8135S Camera Secure Boot signature verification",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116116",
"datePublished": "2026-10-26T04:00:19.398Z",
"dateReserved": "2026-10-25T08:38:37.520Z",
"dateUpdated": "2026-10-26T04:00:19.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116115 (GCVE-0-2026-116115)
Vulnerability from cvelistv5 – Published: 2026-10-26 03:45 – Updated: 2026-10-26 03:45
VLAI
EPSS
VEX
Title
Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization
Summary
A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
- CWE-665 - Improper Initialization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426183 | vdb-entry |
| https://vuldb.com/vuln/426183/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116115 | third-party-advisory |
| https://vuldb.com/submit/1004711 | third-party-advisory |
| https://akosibrylle.me/writeups/yoosee-cve | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yoosee | GM8135S Camera |
Affected:
21.00.01.36
cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:*"
],
"modules": [
"WiFi Configuration"
],
"product": "GM8135S Camera",
"vendor": "Yoosee",
"versions": [
{
"status": "affected",
"version": "21.00.01.36"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "brylleee (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.8,
"vectorString": "AV:A/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T03:45:19.003Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426183 | Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426183"
},
{
"name": "VDB-426183 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426183/cti"
},
{
"name": "CVE-2026-116115 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116115"
},
{
"name": "Submit #1004711 | Gwelltimes Technology Yoosee Smart Camera GM8135S 21.00.01.36 Insecure Default Initialization of Resource",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004711"
},
{
"tags": [
"exploit"
],
"url": "https://akosibrylle.me/writeups/yoosee-cve"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T09:43:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116115",
"datePublished": "2026-10-26T03:45:19.003Z",
"dateReserved": "2026-10-25T08:38:05.356Z",
"dateUpdated": "2026-10-26T03:45:19.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116114 (GCVE-0-2026-116114)
Vulnerability from cvelistv5 – Published: 2026-10-26 03:30 – Updated: 2026-10-26 16:36
VLAI
EPSS
VEX
Title
Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission
Summary
A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:59 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426182 | vdb-entry |
| https://vuldb.com/vuln/426182/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116114 | third-party-advisory |
| https://vuldb.com/submit/1004708 | third-party-advisory |
| https://akosibrylle.me/writeups/yoosee-cve | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yoosee | GM8135S Camera |
Affected:
21.00.01.36
cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116114",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:59:47.582778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T16:36:08.843Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yoosee:gm8135s_camera:*:*:*:*:*:*:*:*"
],
"modules": [
"Live UDP H.264 Video Stream Handler"
],
"product": "GM8135S Camera",
"vendor": "Yoosee",
"versions": [
{
"status": "affected",
"version": "21.00.01.36"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "brylleee (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack\u0027s complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-310",
"description": "Cryptographic Issues",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T03:30:21.410Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426182 | Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426182"
},
{
"name": "VDB-426182 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426182/cti"
},
{
"name": "CVE-2026-116114 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116114"
},
{
"name": "Submit #1004708 | Gwelltimes Technology Yoosee Smart Camera GM8135S 21.00.01.36 Cleartext Transmission of Sensitive Information",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004708"
},
{
"tags": [
"exploit"
],
"url": "https://akosibrylle.me/writeups/yoosee-cve"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T09:42:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116114",
"datePublished": "2026-10-26T03:30:21.410Z",
"dateReserved": "2026-10-25T08:37:06.644Z",
"dateUpdated": "2026-10-26T16:36:08.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-52085 (GCVE-0-2025-52085)
Vulnerability from cvelistv5 – Published: 2025-08-22 00:00 – Updated: 2025-08-26 14:07
VLAI
EPSS
VEX
Summary
An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner and version, current database user and schema, the current DBMS user privileges, and arbitrary data from any table.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-26 13:09 UTC
CWE
- n/a
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-52085",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-26T13:09:31.996089Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T14:07:31.385Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner and version, current database user and schema, the current DBMS user privileges, and arbitrary data from any table."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T17:55:37.780Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://yoosee.app"
},
{
"url": "https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52085",
"datePublished": "2025-08-22T00:00:00.000Z",
"dateReserved": "2025-06-16T00:00:00.000Z",
"dateUpdated": "2025-08-26T14:07:31.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}