CVE-2026-47097

HighCVSS 7.5

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

41th percentile - higher than 41% of all known CVEs

Summary

AJA HELO Plus firmware before version 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware.

Risk Assessment

An attacker can recover the passphrase and decrypt diagnostics bundles from the unauthenticated endpoint, potentially exposing highly sensitive server information.

Recommendation

Upgrade AJA HELO Plus firmware to version 2.1.7 or later, which includes the fix.

Other vulnerabilities in AJA HELO Plus

CVE-2026-47096Medium
AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamID_SystemName value through the /config?action=set web configuration API. When device authentication is disabled, the script persistently executes in the browser of any administrator who opens the web management interface, enabling theft of stored secrets such as web UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials, as well as hijacking of the authenticated session.

Original NVD description (English source)

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly available firmware image to recover the shared passphrase and decrypt diagnostics export bundles retrieved from the unauthenticated diagnostics endpoint on any affected device, exposing highly sensitive server information.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS