Shinobi Systems’ child node service contains a hardcoded connection key prior to commit 5a76c74f. The key can be presented during a WebSocket handshake, after which an unauthenticated attacker can invoke the onWebSocketDataFromChildNode handler to send arbitrary SQL statements, allowing reading or modification of user records and camera configuration.

All installations of the Shinobi surveillance platform that use code before commit 5a76c74f are affected. This includes any project that has not been upgraded to the latest version or has not applied the fix introduced in commit 5a76c74f.

The vulnerability scores a CVSS of 9.3, indicating a high impact and exploitability. EPSS is not available and the issue is not listed in the CISA KEV catalog. Attackers can reach the child node port over the network and immediately authenticate using the hardcoded key, then issue arbitrary database queries. No privileged local presence or additional setup is required, making this a straightforward attack for anyone with network access to the child node service.