Technical impact
A flaw in the Yoosee GM8135S Camera firmware 21.00.01.36 allows an attacker who can reach the camera from the local network to manipulate the file wpa_supplicantX.conf. The manipulation causes improper initialization of the WiFi configuration component, potentially altering wireless network settings without authorization. The vulnerability does not provide remote code execution or direct access to the camera’s internal system, but it can result in unexpected WiFi behavior or undesired reconfiguration. The attacker must be on the same local network and possess the ability to target the camera’s management interface. The exploit is classified as having high complexity and is described as difficult to execute, suggesting that while feasible, it is not trivial. The CVSS score of 2.3 reflects the limited impact, and there is no EPSS data available. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly confirmed exploitation reports. The risk is therefore confined to local network actors capable of interacting with the camera, and the threat is considered low to moderate due to the attack difficulty.
Affected Systems
The vulnerable asset is the Yoosee GM8135S Camera running firmware version 21.00.01.36. Only this firmware revision is documented as vulnerable; no other versions or product variants are known to be affected at this time.
Risk and Exploitability
The low CVSS score of 2.3 and the absence of EPSS data imply a small probability of successful exploitation. An attacker would need to be on the same local network, possess sufficient privileges to upload or modify the wpa_supplicantX.conf file, and navigate a complex exploit path. Because the attack is not remotely exploitative and is listed as difficult, the overall threat remains limited to local network actors and may result in unauthorized WiFi configuration changes rather than widespread system compromise.
