High severity7.5NVD Advisory· Published Sep 30, 2026· Updated Sep 30, 2026

CVE-2026-47097

Description

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly available firmware image to recover the shared passphrase and decrypt diagnostics export bundles retrieved from the unauthenticated diagnostics endpoint on any affected device, exposing highly sensitive server information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

AJA/HELO Plusllm-fuzzy
Range: <2.1.7

Patches

Vulnerability mechanics

References

d26ddnfpy9hzf8.cloudfront.net/aja-web/public/pdf/2026/AJA_HELO_PLUS_ReleaseNotes_v2.1.7.pdfnvd
www.aja.com/support/item/10457nvd
www.vulncheck.com/advisories/aja-helo-plus-static-aes-passphrase-information-disclosure-via-diagsnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000