CVE-2026-4476

MEDIUM

Yi Technology YI Home Camera CGI Endpoint ipc missing authentication

Title source: cna

Description

A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file home/web/ipc of the component CGI Endpoint. Performing a manipulation results in missing authentication. Access to the local network is required for this attack. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (3)

[Vdb Entry] https://vuldb.com/?id.351766

[Signature, Permissions Required] https://vuldb.com/?ctiid.351766

[Third Party Advisory] https://vuldb.com/?submit.773070

Scores

CVSS v3 6.3

EPSS 0.0001

EPSS Percentile 2.0%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-287 CWE-306

Status published

Products (1)

Yi Technology/YI Home Camera 2 2.1.1_20171024151200

Published Mar 20, 2026

Tracked Since Mar 20, 2026