CVE-2026-85083CWE-798hardcoded-credentials

CVE-2026-85083

Medium · published September 11, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially resulting in complete device compromise.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.0 · CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00294 · 20.8th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-09-11T19:17Z
References (2)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-251-01.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-251-01 · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 14:55Z
    CareCam Pro IP Cameras Use of Hard-coded Credentials
    cvelistv5