PT-2026-54915 · Jaiotlink · C492A-W6 Wi-Fi Ip Camera

Andres Valdes · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-58453

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JAIOTlink C492A-W6 Wi-Fi IP camera version 4.8.30.57701411

Description The anyka ipc HTTP service on port 80 accepts a default admin username with an empty password. This allows network-adjacent attackers to gain unauthorized access to camera snapshots, video streams, and network configuration. Additionally, attackers can access factory-level API endpoints, including the SetMAC command injection surface, which allows the execution of arbitrary commands on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-1392

Related Identifiers

CVE-2026-58453

Affected Products

C492A-W6 Wi-Fi Ip Camera

References · 5

• 🔥 https://github.com/rwprimitives/jaiotlink-c492a-wifi-camera/blob/main/writeups/02-default-http-credentials.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-58453 · Security Note
• https://amazon.com/stores/JAIOTlink/page/3B00DC41-70C3-4BAA-925C-3D222C2633D5?lp_asin=B0GX1BNZ78&ref_=ast_bln&store_ref=bl_ast_dp_brandlogo_sto · Note
• https://vulncheck.com/advisories/jaiotlink-c492a-w6-hard-coded-credentials-via-anyka-ipc · Note
• https://twitter.com/VulmonFeeds/status/2072383604638789712 · Twitter Post