{"id":"CVE-2026-47097","published":"2026-09-30T15:22:30.857","lastModified":"2026-09-30T22:16:33.873","description":"AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly available firmware image to recover the shared passphrase and decrypt diagnostics export bundles retrieved from the unauthenticated diagnostics endpoint on any affected device, exposing highly sensitive server information.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-321"],"vendors":[],"products":[],"references":[{"url":"https://d26ddnfpy9hzf8.cloudfront.net/aja-web/public/pdf/2026/AJA_HELO_PLUS_ReleaseNotes_v2.1.7.pdf","tags":[]},{"url":"https://www.aja.com/security-advisories/aja-sa-2026-003","tags":[]},{"url":"https://www.aja.com/support/item/10457","tags":[]},{"url":"https://www.vulncheck.com/advisories/aja-helo-plus-hardcoded-aes-passphrase-for-diagnostics-export-bundle","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The AJA HELO Plus firmware contains a static AES passphrase that can be reverse-engineered from the firmware image, allowing attackers to decrypt sensitive diagnostics bundles without authentication. This exposes highly sensitive server information through an unauthenticated diagnostics endpoint.","exploitability":"Exploitation requires reverse-engineering the firmware image to recover the static passphrase, which is moderately difficult but feasible for determined attackers with access to the firmware binary.","blast_radius":"If exploited, this vulnerability could expose sensitive server configuration details, network settings, and diagnostic information across all affected devices running firmware versions before 2.1.7.","remediation":"Upgrade to firmware version 2.1.7 or later to remediate the static passphrase vulnerability in the diagnostics export functionality.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ics","diagnostics","information-disclosure"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:09:05.890Z"}}