Vulnerability Spotlight: Multiple Vulnerabilities in Yi Technology Home Camera
Summary: Cisco Talos disclosed vulnerabilities in the Yi Technology Home Camera 27US firmware version 1.8.7.0D, with five of them reachable over the network and the rest requiring physical access. The most severe, TALOS-2018-0567, needs only the ability to respond to the camera's frequent time_sync HTTP request to achieve command injection and code execution, and all network-based issues are enabled by cleartext UDP and HTTP traffic described in TALOS-2018-0616.
Bottom line: A camera that syncs time over unencrypted HTTP the moment it joins the network hands an attacker on the path a command injection route to code execution, and a single sniffed token (TALOS-2018-0601) grants owner-level p2p_tnp API access until the device reboots.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026