CVE-2026-85083

The ANJIA AJL33PC0801 IP camera ships with a hard-coded credential used to authenticate to its boot bootloader (CWE-798), so anyone who knows the built-in credential can unlock privileged bootloader access. Triggering the flaw requires physical access to the device (CVSS 4.0 attack vector: Physical), with no privileges or user interaction needed; the attacker simply uses the embedded credential at the boot stage. With privileged bootloader access, an attacker can modify the camera's firmware and system configuration, potentially achieving complete compromise of the device, including persistence across reboots via modified firmware; the CVSS 4.0 vector shows the impact is confined to the device itself (no propagation to connected systems). Affected parties are owners and operators of the ANJIA AJL33PC0801 camera; related coverage also references CareCam Pro IP cameras, but the advisory data does not specify additional confirmed models or version ranges. Exploitation status: the issue is not listed in CISA's KEV, no public proof-of-concept is known, and it carries a CVSS 4.0 base score of 7.0 (High).

What to do: No fixed firmware version is given in the available data, so check with ANJIA for an updated firmware release addressing the hard-coded bootloader credential and apply it when published. Because exploitation requires physical access, restrict physical access to deployed cameras (locked enclosures, controlled premises) and inspect physically accessible units for signs of tampering or modified firmware. If compromise is suspected, reflash the device with firmware from a trusted source, since bootloader-level tampering may not be visible from the running system.