CVE-2026-4476mediumCWE-287CWE-306

CVE-2026-4476: medium-severity vulnerability in YI Home Camera

Yi Technology YI Home Camera CGI Endpoint ipc missing authentication

Published

Follow this CVE+ Monitor YI Home Camera

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file home/web/ipc of the component CGI Endpoint. Performing a manipulation results in missing authentication. Access to the local network is required for this attack. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Yi Technology · YI Home Camera
Related CVEs — YI Home Camera

In the same product, most dangerous first.

CVE-2026-4475HIGHYi Technology YI Home Camera ipc hard-coded credentialsEPSS 0.3%CVE-2026-4478CRITICALYi Technology YI Home Camera HTTP Firmware Update ipc signature verificationEPSS 0.3%CVE-2026-4477LOWYi Technology YI Home Camera WPA/WPS hard-coded keyEPSS 0.2%