JAIOTlink C492A‑W6 Wi‑Fi IP cameras running firmware 4.8.30.57701411 include hard‑coded credentials that allow an attacker to authenticate to the anyka_ipc HTTP service on port 80 using the default admin username with an empty password. Once authenticated one can view camera snapshots and video streams, read and modify network configuration, and invoke factory‑level API endpoints, including the SetMAC command injection surface. The vulnerability is a classic example of CWE‑1392 and results in full unauthorized control over the device and potential intrusions into the local network.

The affected devices are JAIOTlink C492A–W6 4.8.30.57701411 Wi‑Fi IP Camera. No other vendor or product information is provided.

The EPSS score of 2% suggests a low yet non‑negligible likelihood of exploitation. The CVSS score of 9.3 indicates a high severity vulnerability, and the issue is not listed in the CISA KEV catalog. The attack vector is likely local network or any exposed HTTP interface, enabling an attacker who has network access to authenticate immediately using the hard‑coded credentials without further authentication steps.