CVE-2026-4475 HIGH

CVE-2026-4475: Yi Technology YI Home Camera ipc hard-coded credentials

Vendor Yi Technology

Product YI Home Camera

Weakness CWE-798 · Hardcoded credentials

Published March 20, 2026

Last update March 20, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability has been found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The affected element is an unknown function of the file home/web/ipc. Such manipulation leads to hard-coded credentials. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

March 20, 2026 CVE published

March 20, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-4475 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/798.html

Related vulnerabilities

04Related CVE

CVE-2025-34196 Vasion Print (formerly PrinterLogic) Hardcoded PrinterLogic CA Private Key and Hardcoded Password CVE-2025-66237 Sunbird DCIM dcTrack and Power IQ Use of Hard-coded Credentials CVE-2017-13106 Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption CVE-2025-48414 Hard-coded web interface credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations CVE-2025-5379 NuCom NC-WR744G Console Application hard-coded credentials