A weakness in the Yoosee GM8135S Camera firmware 21.00.01.36 allows remote actors to manipulate a function in the /npc/npc file of the Live UDP H.264 Video Stream Handler, causing the camera to transmit sensitive data in cleartext. This flaw is a cleartext transmission vulnerability that compromises confidentiality of whatever information is sent through the stream. Attackers can capture this data over the network without encryption, exposing the camera and its environment to potential exploitation.

The affected product is the Yoosee GM8135S Camera, version 21.00.01.36. No other vendors or products are listed as impacted.

The CVSS v3.1 score of 6.3 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying it has not yet been widely exploited in the wild. However, the attack vector is remote over the network, and the exploitation is reported as difficult but publicly available. The vulnerability can be exploited by sending crafted UDP packets to trigger the /npc/npc function, resulting in plaintext transmission. Because the camera is typically accessible over local or wide area networks, the risk is significant for environments where network traffic is not monitored or filtered.