Vulnerability · Published Sep 30, 2026 · Assigned by VulnCheck

CVE-2026-47097AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle

High 7.5

In plain English

A high-severity security flaw in HELO Plus from AJA Video Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 67.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly available firmware image to recover the shared passphrase and decrypt diagnostics export bundles retrieved from the unauthenticated diagnostics endpoint on any affected device, exposing highly sensitive server information.

Affected products (as reported)

Vendor	Product	Versions
AJA Video Systems	HELO Plus	0 – before 2.1.7

Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Vendor Advisory vendor-advisory
Release Notes release-notes
Support Download patch, product
https://www.vulncheck.com/advisories/aja-helo-plus-hardcoded-aes-passphrase-for-diagnostics-export-bundle third-party-advisory