A vulnerability exists in the Yi Technology YI Home Camera 2 HTTP Firmware Update Handler (file home/web/ipc). The flaw allows an attacker to bypass cryptographic signature verification, enabling the delivery of malicious firmware. This compromise can lead to full system takeover, exposing the camera to arbitrary code execution and disclosure of sensitive data. The weakness is a failure of signature verification, corresponding to CWE-345 (Improper Validation of Cryptographic Signature) and CWE-347 (Use of Incorrect Key or Certificate Information).

Yi Technology’s YI Home Camera 2, specifically firmware version 2.1.1_20171024151200, is affected. No other versions are listed in the CVE data.

The vulnerability receives a CVSS score of 9.2, indicating critical severity. No EPSS data is available. It is not included in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw remotely via the HTTP firmware update interface; the complexity is high and exploitation is described as difficult, yet publicly available exploits may exist. The primary risk is the potential for undetected malicious firmware injection leading to remote code execution.