CVE-2026-85083

MediumCVSS 6.8/10Last modified Sep 18, 2026

Description

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially resulting in complete device compromise.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 11, 2026
Last modified: Sep 18, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-850846.3Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buff CVE-2026-850859.6The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page l CVE-2026-850866.9Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This CVE-2026-850876.9Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Th CVE-2026-850886.9Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default acces CVE-2026-850896.5FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. T CVE-2026-85098.8Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox CVE-2026-850905.4FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane r CVE-2026-850917.4zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gz CVE-2026-850926.6LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path p CVE-2026-850936.5Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory CVE-2026-850948.8The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat