CVE-2026-4475: YI Home Camera 2 Auth Bypass Vulnerability

CVE-2026-4475 Overview

A hard-coded credentials vulnerability has been identified in Yi Technology YI Home Camera 2 firmware version 2.1.1_20171024151200. The vulnerability exists in an unknown function within the file home/web/ipc, where hard-coded credentials are embedded in the device firmware. An attacker with access to the local network can exploit this vulnerability to gain unauthorized access to the affected camera system.

Critical Impact

Successful exploitation allows unauthorized access to the IoT camera system, potentially compromising video surveillance feeds, device configuration, and enabling further network infiltration from an adjacent network position.

Affected Products

• Yi Technology YI Home Camera 2 firmware version 2.1.1_20171024151200

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-4475 published to NVD
• 2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-4475

Vulnerability Analysis

This vulnerability is classified under CWE-259 (Use of Hard-coded Password), representing a significant security weakness commonly found in IoT and embedded devices. The hard-coded credentials are located within the home/web/ipc file, which appears to be part of the web interface component of the YI Home Camera 2.

Hard-coded credentials in IoT devices present a persistent security risk because they cannot be changed by end users and remain constant across all devices using the same firmware version. This means that once discovered, these credentials can be used to compromise any YI Home Camera 2 running the affected firmware version within reach of an attacker on the adjacent network.

The vendor was contacted about this disclosure but did not respond, leaving users without an official patch or remediation guidance.

Root Cause

The root cause of this vulnerability is the inclusion of static, unchangeable credentials directly embedded in the device firmware. This is a common development shortcut in IoT devices where developers hardcode authentication credentials for debugging, maintenance access, or inter-component communication. These credentials were not removed or made configurable before the firmware was released to production, creating a backdoor that persists across all deployed devices.

Attack Vector

This vulnerability requires adjacent network access (local network) for successful exploitation. An attacker positioned on the same network segment as the vulnerable camera can leverage the hard-coded credentials to authenticate to the device's web interface at home/web/ipc. The attack does not require any prior authentication or user interaction.

The exploit has been publicly disclosed, meaning that the hard-coded credentials are now available to potential attackers. Attack scenarios include:

1. An attacker on the same WiFi network as the camera can directly authenticate using the known credentials
2. Compromised devices on the home network can pivot to attack the camera
3. Malicious actors with physical access to the network can enumerate and compromise vulnerable cameras

Detection Methods for CVE-2026-4475

Indicators of Compromise

• Unexpected authentication attempts to the camera's web interface from non-standard sources on the local network
• Unusual configuration changes on the YI Home Camera 2 device
• Anomalous network traffic patterns originating from or directed to the camera's IP address on port 80 or other web service ports

Detection Strategies

• Implement network monitoring to detect authentication attempts to the home/web/ipc endpoint on YI Home Camera 2 devices
• Deploy network segmentation and monitor for cross-segment traffic attempting to reach IoT devices
• Use endpoint detection solutions to identify lateral movement attempts targeting IoT device management interfaces

Monitoring Recommendations

• Enable logging on network infrastructure to capture authentication events to IoT devices
• Configure IDS/IPS rules to alert on access attempts to known vulnerable endpoints on YI Home Camera 2 devices
• Monitor for firmware enumeration or reconnaissance activity targeting camera devices on the network

How to Mitigate CVE-2026-4475

Immediate Actions Required

• Isolate affected YI Home Camera 2 devices on a separate network segment with restricted access from untrusted hosts
• Implement network access controls (ACLs) to limit which devices can communicate with the vulnerable cameras
• Monitor network traffic to and from affected devices for signs of unauthorized access
• Consider disabling or disconnecting vulnerable cameras until a patch is available or alternative mitigations are in place

Patch Information

No official patch is currently available from Yi Technology. The vendor was contacted regarding this vulnerability but did not respond. Users should monitor VulDB Entry #351765 and vendor communications for any future security updates.

Workarounds

• Implement strict network segmentation to isolate IoT cameras from critical network resources and untrusted devices
• Deploy a firewall or VLAN to restrict adjacent network access to the camera's web interface
• If possible, disable the web interface on affected cameras and use alternative management methods
• Consider replacing affected devices with cameras from vendors that provide regular security updates and have responsive security disclosure processes

# Network segmentation example - restrict camera access
# Add firewall rule to limit access to camera IP (example using iptables)
iptables -A FORWARD -d 192.168.1.100 -s 192.168.1.0/24 -j DROP
iptables -A FORWARD -d 192.168.1.100 -s 192.168.10.50 -j ACCEPT  # Allow only management host