Vulnerability · Published Mar 20, 2026 · Assigned by VulDB
CVE-2026-4478Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification
High 8.1
In plain English
A high-severity insufficient verification of data authenticity in YI Home Camera from Yi Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
A vulnerability was identified in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This impacts an unknown function of the file home/web/ipc of the component HTTP Firmware Update Handler. The manipulation leads to improper verification of cryptographic signature. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Yi Technology | YI Home Camera | 2 2.1.1_20171024151200 |
Weakness: CWE-347, CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-351768 | Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification vdb-entry
- VDB-351768 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #773162 | yitechnology YI Home Camera 2 2.1.1_20171024151200 HTTP Firmware OTA Without Cryptographic Signature third-party-advisory