A vulnerability in Yi Technology YI Home Camera 2 allows an attacker with local network access to exploit an unknown function within the home/web/ipc file, resulting in the use of hard‑coded credentials. Because the credentials are embedded in the firmware, an attacker can log in without needing to guess or brute force passwords, giving them full control over the camera’s functions and potentially enabling remote viewing, recording, and configuration changes. This constitutes a loss of confidentiality, integrity, and availability of the device’s security posture.

Only the Yi Technology YI Home Camera 2 running firmware version 2.1.1_20171024151200 is known to be affected. No other versions or models are listed in the CVE data.

The vulnerability is rated high with a CVSS score of 8.7, indicating significant impact and exploitability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is local network access; an attacker must be connected to the same LAN segment as the camera to exploit the hard‑coded credentials. Since the exploit has been publicly disclosed and the vendor has not provided a response, the risk remains significant until a patch or mitigation is applied.