AJA HELO Plus: Information disclosure via hard-coded AES passphrase
Summary
AJA HELO Plus firmware before 2.1.7 embeds a static AES passphrase in obfuscated form. An unauthenticated attacker over the network can retrieve diagnostics export bundles from the diagnostics endpoint, reverse engineer the publicly available firmware to recover the passphrase, and decrypt the bundles. The exposed data is highly sensitive server information, which can support reconnaissance.
Affected
- AJA HELO Plus firmware before 2.1.7
- Unknown whether other AJA products are affected.
Fixed in
- Upgrade to HELO Plus firmware/software v2.1.7 (AJA product page lists release date 9/1/2026).
- The release notes describe a change to how diagnostic information is exported; the link to this CVE is inferred, not confirmed.
Workaround
- Unknown. No workaround is documented in the sources reviewed.
Exploitation
- No public exploit code has been confirmed (TheHackerWire, aggregator source).
- No evidence of exploitation in the wild; not listed in CISA KEV according to one aggregator (not directly verified).
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Inventory all HELO Plus units and their firmware versions.
- Update every unit below 2.1.7 after checking the AJA advisory SA-2026-003 and download page.
- Confirm no HELO Plus device is reachable from the internet; restrict access to the web interface and diagnostics export to a management VLAN or known admin hosts if patching is delayed.
- Also check patch status for AJA advisory SA-2026-002 (firmware v2.1.6 minimum), which addresses separate vulnerabilities in the same device family.
- Re-check the CISA KEV catalog and vendor notices.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AJA HELO Plus Release Notes v2.1.7 d26ddnfpy9hzf8.cloudfront.net
- AJA Security Advisory SA-2026-003 www.aja.com
- AJA Download page HELO Plus (item 10457) www.aja.com
- VulnCheck advisory: AJA HELO Plus hard-coded AES passphrase www.vulncheck.com
- AJA Security Advisory SA-2026-002 www.aja.com
- AJA HELO Plus product page www.aja.com
- Strix CVE-2026-47097 www.strix.ai
- TheHackerWire CVE-2026-47097 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:37.
Original description (NVD)
AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly available firmware image to recover the shared passphrase and decrypt diagnostics export bundles retrieved from the unauthenticated diagnostics endpoint on any affected device, exposing highly sensitive server information.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.