CVE-2026-58453: JAIOTlink C492A-W6 4.8.30.57701411 Hard-coded Credentials via anyka_ipc

Synopsis

A hard-coded credentials vulnerability exists in JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware version 4.8.30.57701411. The anyka_ipc HTTP service on port 80 accepts the default admin username with an empty password, reachable over the network with no authentication required from an attacker. Successful exploitation gives full access to camera snapshots, live video streams, network configuration, and factory-level API endpoints including a command injection surface via the SetMAC command. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The anyka_ipc service listens on port 80 and must be reachable over the network; an attacker needs IP-level access to the camera's HTTP interface.

• AuthenticationNot required

  No attacker credentials are required; the service accepts the built-in admin username with an empty password, making authentication a non-barrier.

• Victim interactionNot required

  No victim action is needed; the attacker connects directly to the service without any user involvement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free with no race conditions or special environmental setup required.

Blast Radius

• Attacker reads live video streams and stored camera snapshots, exposing whatever the camera observes.
• Attacker reads and modifies network configuration settings on the device.
• Attacker reaches factory-level API endpoints, including the SetMAC command injection surface, enabling arbitrary command execution on the device.
• Attacker disrupts camera availability by reconfiguring or crashing the anyka_ipc service.