Three vulnerabilities in Yoosee smart cameras built on the Grain Media GM8135S chip were published in the US National Vulnerability Database on October 26, 2026. They affect firmware up to and including 21.00.01.36, possibly other versions too. The vendor, Shenzhen Gwell Times, has not responded to the researcher and has not released a fix. The research and proof-of-concept steps are public.

According to the researcher, these cameras sell on marketplaces such as Lazada, Shopee and TikTok Shop for 400-800 Philippine pesos, roughly 6-12 euros. They are set up with the Yoosee phone app, so the app name is often the easiest way to tell whether a cheap camera is one of them.

Live video in the clear, over the internet

The researcher, who publishes as Brylle, put the camera behind a laptop acting as a router and captured its traffic with Wireshark while the Yoosee app showed the live view. The camera's /npc/npc process sent the stream as raw H.264 frames over UDP to a public IP address, with no encryption. Stripping an 80-byte header from each packet was enough to play the video back with ffplay or convert it to MP4.

That means anyone who can see the traffic can watch the stream: another device on the same network, a compromised router, or someone along the route to Yoosee's servers. This is CVE-2026-116114. VulDB, which assigned the IDs, rates it as remotely exploitable but hard to pull off.

It joins open networks by itself

The second issue, CVE-2026-116115, is in the camera's default Wi-Fi configuration. It ships with wpa_supplicant files that make it connect automatically to open networks called "Free-AP0" to "Free-AP3". The researcher created a password-less hotspot named Free-AP0 on a phone, and the camera connected to it. An attacker nearby can knock the camera off its usual network with a deauthentication attack and wait for it to join theirs, then capture the unencrypted video.

No firmware signature check

The third, CVE-2026-116116, is about the firmware itself. The XM25QH64 flash chip that holds it can be read, modified and written back, and the camera boots the modified image without checking a signature. This needs physical access. VulDB scores it 8.4 under CVSS 4.0.

What owners can do

The disclosure timeline in the write-up starts on June 6, 2026, when the vendor was emailed, and the write-up went public on July 20. The CVE entries appeared only now, and there is still no update. The researcher's advice:

  • Put the camera on a separate IoT VLAN and block its outbound internet access with a firewall.
  • For remote viewing, take the local RTSP stream on port 554 into a self-hosted NVR, for example Frigate, and expose that over TLS instead of using the Yoosee app's cloud path.
  • Connect the camera by Ethernet where possible, so it cannot be pushed onto a rogue Free-AP network.
  • If none of that is practical, replace it with a camera that encrypts its stream by default.