Description
A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This affects an unknown function of the component WPA/WPS. Executing a manipulation can lead to use of hard-coded cryptographic key
. The attack can only be done within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-20
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Use of Hard‑coded Cryptographic Key
Action: Assess Impact
AI Analysis

Impact

A flaw was identified in the WPA/WPS component of the Yi Technology YI Home Camera 2. The vulnerability is triggered by executing a manipulation that causes the device to use a hard‑coded cryptographic key. The CVE description states that this action can lead to the use of the hard‑coded key but does not explicitly describe additional effects such as data decryption or unauthorized access.

Affected Systems

The affected product is Yi Technology YI Home Camera 2, specifically firmware version 2.1.1_20171024151200. No other versions are listed as affected in the data.

Risk and Exploitability

This exploit requires local network access, entails high complexity and is reported as difficult to execute. The CVSS score is 2.3, EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The combination of local‑only attack surface, high complexity, and low severity score indicates a low to moderate overall risk, contingent on network segregation and device exposure.

Generated by OpenCVE AI on March 20, 2026 at 08:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check for and install any consensus firmware updates from Yi Technology that address the hard‑coded key issue.
  • If no update is available, isolate the camera from critical network segments or place it on a dedicated VLAN.
  • If the camera provides an option, disable WPS functionality to reduce the attack surface related to the vulnerable component.
  • Monitor the local network for unusual activity that may indicate exploitation attempts.
  • Verify that the camera’s WPA configuration uses a unique, user‑defined key and replace the default key if necessary.

Generated by OpenCVE AI on March 20, 2026 at 08:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 20 Mar 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Yitechnology
Yitechnology yi Home Camera
Vendors & Products Yitechnology
Yitechnology yi Home Camera

Fri, 20 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 20 Mar 2026 07:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This affects an unknown function of the component WPA/WPS. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack can only be done within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Yi Technology YI Home Camera WPA/WPS hard-coded key
Weaknesses CWE-320
CWE-321
References
Metrics cvssV2_0

{'score': 1.8, 'vector': 'AV:A/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.1, 'vector': 'CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Yitechnology Yi Home Camera
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-20T15:45:32.782Z

Reserved: 2026-03-19T20:46:27.311Z

Link: CVE-2026-4477

cve-icon Vulnrichment

Updated: 2026-03-20T15:45:28.584Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-20T07:16:14.497

Modified: 2026-03-20T13:37:50.737

Link: CVE-2026-4477

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-20T16:27:59Z

Weaknesses