---
id: "CVE-2026-116116"
kind: "vulnerability"
aliases: ["CVE-2026-116116"]
title: "Yoosee GM8135S camera: Secure Boot accepts improperly verified signatures, allowing firmware tampering"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["camera", "firmware", "gm8135s", "infrastructure", "iot", "yoosee"]
not_affected_if: ["no-device-access", "other-firmware-version"]
published_at: "2026-10-26T04:17:55+00:00"
first_seen_at: "2026-10-26T04:58:33+00:00"
updated_at: "2026-10-26T04:59:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116116", "first_seen_at": "2026-10-26T04:58:33+00:00"}]
---

# Yoosee GM8135S camera: Secure Boot accepts improperly verified signatures, allowing firmware tampering

The Yoosee GM8135S camera firmware 21.00.01.36 fails to properly verify the cryptographic signature in its Secure Boot component. An attacker with local access can get modified code accepted at boot.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Read the firmware version on the device and compare it to `21.00.01.36`
- unknown for other checks; the sources do not describe a configuration to inspect

## Fix

- unknown: the vendor did not respond to disclosure and the sources list no patched version or workaround

## Timeline

- 2026-10-26T04:58:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116116

## From the sources

A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_