Firmware for AJA HELO Plus devices prior to version 2.1.7 contains a static AES encryption passphrase that is embedded in an obfuscated form within the binary. An attacker who can download the public firmware image can reverse‑engineer the passphrase and then retrieve diagnostic bundles from the unauthenticated "/diags" endpoint. Decrypting those bundles reveals highly sensitive server information. The weakness is a classic static encryption key exposure and is identified as CWE‑321.

The vulnerability applies to all AJA Video Systems HELO Plus units running firmware versions older than 2.1.7. Any device of that line that has not yet been updated to 2.1.7 or later is affected.

The CVSS score of 8.7 signals a high‑severity flaw. Because the endpoint is accessible without authentication and the passphrase can be extracted from the firmware, the exploit path is straightforward: download firmware, recover the key, perform an unauthenticated request to /diags, capture and decrypt the diagnostics bundle. The EPSS score is not available, but the public nature of the firmware and the trivial reverse‑engineering steps indicate that exploitation is plausible. The vulnerability is not listed in the CISA KEV catalog, but the impact on confidentiality is severe and warrants prompt attention.