CVE-2026-4478
A vulnerability was identified in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This impacts an unknown function of the file home/web/ipc of the component HTTP Firmware Update Handler. The manipulation leads to improper verification of cryptographic signature. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.2
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.27%
- CWE
- CWE-347, CWE-345
- Published
- 2026-03-20
- Last modified
- 2026-03-20
Affected products
- Yi Technology YI Home Camera
Weakness type
Related vulnerabilities
- CVE-2026-80469 — CVE-2026-80469
- CVE-2026-73784 — HPE IceWall products, Remote Bypass of Security Restrictions
- CVE-2026-89169 — live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection...
- CVE-2026-89086 — In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only...
- CVE-2026-89043 — passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending
- CVE-2026-89042 — passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification
- CVE-2023-54355 — PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve
- CVE-2026-79970 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...