CVE-2026-77974

Deferred Deferred - Pending Action

Firmware Spoofing via Unsigned Update Channel

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: ICS-CERT

Description

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-77974

EUVD

EUVD-2026-75056

Affected Vendors & Products

Vendor	Product	Version / Range
softish	c6_ear_camera	*
softish	earvision	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-77974 is a high-severity vulnerability affecting the Softish C6 Ear Camera and EarVision Android application. An attacker can spoof the device and trick a user into confirming a firmware update. After obtaining user confirmation, the attacker transmits unauthorized firmware through an unauthenticated and unsigned update channel.

Detection Guidance

Detecting this vulnerability requires monitoring for unauthorized firmware update attempts. Check network traffic for unexpected firmware transmission requests to the Softish C6 Ear Camera or EarVision app. Inspect system logs for unusual update confirmations or unsigned firmware installations.

Impact Analysis

An attacker could exploit this to install malicious firmware on your device without proper authentication. This may lead to unauthorized access, data theft, or device compromise. Users should avoid confirming unexpected firmware updates.

Compliance Impact

This vulnerability could potentially violate compliance with standards like GDPR and HIPAA due to unauthorized firmware transmission through an unauthenticated channel. Unauthorized firmware changes may compromise data integrity and confidentiality, which are critical requirements under these regulations.

Mitigation Strategies

Disable automatic firmware updates if available. Avoid confirming any unexpected firmware update requests. Contact the vendor Softish for official remediation steps since no patch is currently available.

Hi! I’m here to help you understand CVE-2026-77974. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70