Vulnerability · Published Sep 30, 2026 · Assigned by VulnCheck

CVE-2026-47096AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter

Medium 6.1

In plain English

A medium-severity cross-site scripting in HELO Plus from AJA Video Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 85.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamID_SystemName value through the /config?action=set web configuration API. Attackers can exploit this flaw when device authentication is disabled to persistently execute arbitrary script in the browser of any administrator who opens the web management interface, enabling theft of stored secrets such as web UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials, as well as hijacking of the authenticated session.

Affected products (as reported)

Vendor	Product	Versions
AJA Video Systems	HELO Plus	0 – before 2.1.7

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Vendor Advisory vendor-advisory
Release Notes release-notes
Support Download patch, product
https://www.vulncheck.com/advisories/aja-helo-plus-stored-xss-via-system-name-parameter third-party-advisory