{"id":"CVE-2026-116114","kind":"vulnerability","aliases":["CVE-2026-116114"],"related":[],"title":"Yoosee GM8135S camera: video stream handler sends sensitive data in cleartext","description":"A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Yoosee GM8135S camera firmware 21.00.01.36 sends sensitive information in cleartext through its Live UDP H.264 video stream handler at /npc/npc. A remote attacker who can observe or reach that traffic can read the data, and a public exploit exists.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firmware","gm8135s","infrastructure","iot-camera","yoosee"],"not_affected_if":["no-remote-access","other-firmware-version"],"how_to_check":"- Check the camera firmware version in its web or app settings; unknown whether the sources give a command or path for this\n- Confirm whether the camera's UDP stream traffic crosses networks an attacker could observe","fix":"- No vendor fix: the vendor did not respond to disclosure\n- Isolate the camera on a separate network segment and block remote access to it until a fix exists","status":"open","published_at":"2026-10-26T04:17:54+00:00","first_seen_at":"2026-10-26T04:58:33+00:00","triaged_at":"2026-10-26T04:59:40+00:00","updated_at":"2026-10-26T04:59:40+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T04:59:40Z","model":"claude-haiku-5-5","output":{"fix":"- No vendor fix: the vendor did not respond to disclosure\n- Isolate the camera on a separate network segment and block remote access to it until a fix exists","reach":"internet","title":"Yoosee GM8135S camera: video stream handler sends sensitive data in cleartext","impact":"medium","summary":"The Yoosee GM8135S camera firmware 21.00.01.36 sends sensitive information in cleartext through its Live UDP H.264 video stream handler at /npc/npc. A remote attacker who can observe or reach that traffic can read the data, and a public exploit exists.","category":"infrastructure","nicknames":[],"who_cares":["yoosee","gm8135s","iot-camera","firmware"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sensitive camera data readable in cleartext by remote attacker","analyst_note":"Confirm the exact data exposed and affected firmware range from the NVD entry and any vendor or researcher advisory; the sources give no fix or check.","how_to_check":"- Check the camera firmware version in its web or app settings; unknown whether the sources give a command or path for this\n- Confirm whether the camera's UDP stream traffic crosses networks an attacker could observe","needs_analyst":true,"not_affected_if":["no-remote-access","other-firmware-version"],"who_is_affected":"Owners of Yoosee GM8135S cameras running firmware 21.00.01.36 that are reachable from the internet or an untrusted network. Sources do not say which other firmware versions or models are affected, so the exposure of other units is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000631,"input_tokens":3381,"output_tokens":586,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116114':14A,17A '-2026':13A,16A '/npc/npc':45B,83C '21.00.01.36':30B,74C 'affect':76C 'attack':48B,102C,108C,135C 'avail':126C 'camera':3A,23B,28B,73C 'caus':95C 'cleartext':11A,35B,96C 'complex':110C 'compon':86C 'contact':139C 'could':131C 'cve':12A,15A 'data':9A,59B 'difficult':120C 'disclosur':143C 'earli':140C 'exist':64B 'exploit':63B,116C,122C 'file':82C 'firmwar':18B,29B 'function':79C 'gm8135s':2A,19B,27B,72C 'h.264':40B,89C 'handler':6A,43B,92C 'high':114C 'identifi':69C 'inform':33B,100C 'infrastructur':20B 'initi':105C 'iot':22B 'iot-camera':21B 'live':38B,87C 'made':125C 'manipul':94C 'observ':51B 'public':62B,129C 'rate':112C 'reach':53B 'read':57B 'remot':47B,106C 'report':118C 'respond':147C 'send':7A,31B 'sensit':8A,32B,99C 'stream':5A,42B,91C 'traffic':55B 'transmiss':97C 'udp':39B,88C 'unknown':78C 'use':133C 'vendor':137C 'video':4A,41B,90C 'way':150C 'weak':66C 'yoose':1A,24B,26B,71C","nicknames":[],"mitigations":[],"who_affected":"Owners of Yoosee GM8135S cameras running firmware 21.00.01.36 that are reachable from the internet or an untrusted network. Sources do not say which other firmware versions or models are affected, so the exposure of other units is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T04:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116114","severity":null,"published_at":"2026-10-26T04:17:54+00:00","modified_at":"2026-10-26T04:17:54+00:00","first_seen_at":"2026-10-26T04:58:33+00:00","fetched_at":"2026-10-26T04:58:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}