CVE-2026-12192: GALAYOU Y4 Web Server buffer overflow

Synopsis

A buffer overflow vulnerability affects the web server component of the GALAYOU Y4 firmware version 1.0.0. The flaw is reachable from the local network (LAN, adjacent segment, or VPN) without any authentication required. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the device, including the ability to read stored data, tamper with device state, and crash or take over the service. No fix version has been published; HarborGuard tracks the advisory and will make a patched rebuild available the moment an upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same local network, adjacent segment, or connected VPN as the target device; remote internet-based access is not sufficient.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to reach the vulnerable web server endpoint.

• Victim interactionNot required

  The attacker can trigger the buffer overflow without any action from a user on the target device.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental setup required.

Blast Radius

• A successful attacker reads all data accessible to the web server process, including stored credentials, session tokens, and camera configuration.
• The attacker can write or modify device configuration, potentially redirecting video feeds or altering access control settings.
• The web server process can be crashed, making the device management interface unavailable and potentially disrupting camera operation.
• With full confidentiality, integrity, and availability impact on the device, the attacker can use it as a foothold for further lateral movement within the local network segment.