Yoosee GM8135S Camera: Improper signature verification in Secure Boot
Summary
Yoosee GM8135S Camera firmware 21.00.01.36 does not properly verify cryptographic signatures in its Secure Boot component. An attacker with high privileges and local access can manipulate the boot image so that it passes the check, which may allow tampered firmware to run on the device and persist across reboots. A public exploit exists, the vendor did not respond, and no fix is known.
Affected
- Yoosee GM8135S Camera, firmware 21.00.01.36
- Other versions: Unknown.
Fixed in
- No fixed version is known.
- The vendor has not released a firmware update as of publication.
Workaround
- Isolate the camera on a dedicated IoT VLAN without internet access and without access to business systems.
- Restrict local and administrative access to trusted persons only.
- Connect the camera via Ethernet instead of WiFi to prevent automatic connection to rogue networks.
- Replace the device if the supplier provides no firmware statement.
Exploitation
- Public exploit: yes, according to the CVE description. A writeup is referenced.
- Known exploited: not listed in the sources reviewed; not verified against the CISA KEV catalogue.
Our recommendation
- Inventory all Yoosee GM8135S cameras and their firmware versions.
- Isolate them in a separate IoT network without internet access.
- Do not rely on the device for security-relevant functions while it is unpatched.
- Monitor for firmware updates and plan replacement if no fix is published.
- Note the CVSS discrepancy in your records: 8.4 (CVSS 4.0) in the CNA data, 9.3 in some aggregators.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-116116 vuldb.com
- VulDB vulnerability 426184 vuldb.com
- VulDB submission 1004712 vuldb.com
- Writeup akosibrylle akosibrylle.me
- HOL Guard CVE-2026-116116 hol.org
- Vulners CVELIST CVE-2026-116116 vulners.com
- OpenCVE CVE-2026-116116 app.opencve.io
- Strix CVE-2026-116116 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:05.
Original description (NVD)
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.