CVE-2026-116114
Received Received - Intake

Cleartext Credential Transmission in Yoosee GM8135S Camera

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116114
EUVD
EUVD-2026-109606

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Yoosee GM8135S Camera 21.00.01.36

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-310 Cryptographic Issues
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Yoosee GM8135S Camera transmitting live video streams over UDP in cleartext, exposing sensitive information during active streaming sessions. The issue arises from insecure default settings and lack of firmware verification, allowing potential firmware manipulation. Attackers can intercept video feeds by exploiting weak WiFi configurations or positioning near the device.

Detection Guidance

Monitor network traffic for unencrypted UDP video streams from the Yoosee GM8135S Camera. Use tools like Wireshark to capture and inspect packets for cleartext transmission of sensitive data. Check if the camera connects to default WiFi networks like 'Free-AP0' or 'Free-AP1'.

Impact Analysis

This vulnerability allows attackers to passively monitor environments without detection, posing significant privacy risks for home or business users. Sensitive information transmitted in cleartext could be intercepted, and video feeds may be accessed by unauthorized parties if the camera is connected to unsecured WiFi networks.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Cleartext transmission and potential interception violate these regulations.

Mitigation Strategies

Isolate the camera on a dedicated IoT VLAN to limit exposure. Use secure RTSP streams with TLS encryption instead of UDP. Avoid using WiFi; connect via Ethernet to prevent interception. Replace the device if possible, as no patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116114. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart