CVE-2026-58453: Verified Repro With Script Download

CVE-2026-58453 is a hard-coded/default credential vulnerability in the JAIOTlink C492A-W6 Wi-Fi IP camera HTTP service. The camera-family Anyka/N1 anyka_ipc HTTP service protects privileged NetSDK API endpoints with HTTP Basic authentication, but the default/factory account path provisions admin with an empty password. A network-adjacent attacker who can reach the camera HTTP service can send Authorization: Basic YWRtaW46 (admin:) and receive protected resources such as /NetSDK/System/deviceInfo and snapshot endpoints.

• Package/component affected: JAIOTlink C492A-W6 Wi-Fi IP camera firmware, anyka_ipc / Anyka N1 HTTP NetSDK service.
• Affected versions: Reported vulnerable firmware 4.8.30.57701411; reproduced against the real Anyka N1/anyka_ipc HTTP service library code used by this camera family (libNkN1API.a, version string 1.5.7.38) and the disclosed device behavior.
• Risk level and consequences: Critical. A network-adjacent attacker can authenticate using predictable credentials and access protected camera APIs. The demonstrated impact is authorization bypass to protected NetSDK device information; the same authenticated surface includes snapshots, video/configuration endpoints, and factory APIs described in the disclosure.

Impact Parity

• Disclosed/claimed maximum impact: Authorization bypass/default credential access to snapshots, video streams, configuration, and factory APIs via HTTP Basic auth using admin with an empty password.
• Reproduced impact from this run: Runtime API access through a real TCP HTTP boundary into the original Anyka N1/anyka_ipc NetSDK service code. The vulnerable service returned HTTP 200 OK and protected /NetSDK/System/deviceInfo JSON for admin: while no-auth and admin:wrong returned HTTP 401 Unauthorized. A fixed/remediated comparison using a non-empty admin password rejected admin: and accepted only the configured non-empty password.
• Parity: full for the claimed API authentication bypass behavior on the NetSDK HTTP surface.
• Not demonstrated: This run did not use a physical JAIOTlink C492A-W6 camera or stream real camera video. Snapshot path reachability was exercised through the same service boundary with a minimal callback-provided JPEG, while the primary protected-resource oracle is /NetSDK/System/deviceInfo from the real NetSDK HTTP handler.

Root Cause

The vulnerable account is created by the original Anyka N1 user-loading path. In source/anyka_ipc/cloud/n1/src/n1_init.c, n1_usr_load() opens N1_USR_FILE_PATH (/etc/jffs2/usr.conf). If the user file cannot be opened, which is the factory/default-user case, it calls:

NK_N1Device_AddUser("admin", "", 0);

The same fallback is also used if allocation fails while loading the user file. The NetSDK HTTP handler in libNkN1API.a contains the Basic-auth and NetSDK route code (Authorization, Basic realm="nkHTTP", /NetSDK/System/deviceInfo, /snapshot.jpg, N1_Device_HandleNetSDKHTTP, N1_Device_HandleNetSDK). The handler decodes the Basic credential, checks the username with NK_N1Device_HasUser(), then compares the supplied password to the stored password. Because the stored default password is the empty string, the Basic credential admin: is accepted and protected routes are served.

No upstream fix commit is known from the ticket. The reproduction includes a negative control representing the expected fixed behavior: provision admin with a non-empty password. In that remediated configuration, admin: fails with HTTP 401 Unauthorized, while admin:fixed-secret succeeds.

Reproduction Steps

1. Run bundle/repro/reproduction_steps.sh.
2. The script:
   • Reuses/clones the disclosure repository at the durable cache path.
   • Reuses/clones the Anyka SmartCamera source at commit a5bece938ff0dc019ead3d62fa6adefbc8c497fe.
   • Builds an ARM launcher that links directly against the original libNkN1API.a, libNkUtils.a, and libbase.a Anyka N1 service libraries.
   • Runs the ARM service under qemu-arm, exposing a localhost TCP HTTP listener.
   • Performs two vulnerable attempts where the real service is provisioned with admin and an empty password.
   • Performs two fixed/negative-control attempts where the service is provisioned with admin and a non-empty password.
3. Expected evidence:
   • Vulnerable attempts: no-auth and admin:wrong get 401, but admin: gets 200 and protected NetSDK JSON.
   • Fixed attempts: no-auth, admin:wrong, and admin: get 401; admin:fixed-secret gets 200.

Evidence

Primary logs and artifacts:

• bundle/logs/reproduction_steps.log — full build/run/test transcript.
• bundle/repro/runtime_manifest.json — runtime evidence manifest showing entrypoint_kind="api_remote", service_started=true, healthcheck_passed=true, and target_path_reached=true.
• bundle/repro/source_identity.txt — source and library identity, including the n1_usr_load() fallback and libNkN1API.a NetSDK/auth strings.
• bundle/logs/vulnerable_attempt1_admin_empty_netsdk.headers.txt — vulnerable admin: response headers:
  • HTTP/1.1 200 OK
  • Server: nkHTTP / 1.4
  • Content-Type: text/json
• bundle/logs/vulnerable_attempt1_admin_empty_netsdk.body — protected NetSDK JSON returned to admin::
  • "sdkVersion":"1.5.7.38"
  • "firmwareVersion":"1.5.7.38"
  • "macAddress":"00:00:00:00:00:00"
• bundle/logs/fixed_attempt1_admin_empty_netsdk.body — fixed comparison rejects admin::
  • "statusMessage":"Unauthorized"
• bundle/logs/fixed_attempt1_configured_password_netsdk.body — fixed comparison remains healthy and returns protected NetSDK JSON only with the configured non-empty password.

Key excerpt from the successful second verification run:

vulnerable attempt 1 status summary: noauth=401 wrong=401 admin_empty=200 expected_admin_empty=200
vulnerable attempt 2 status summary: noauth=401 wrong=401 admin_empty=200 expected_admin_empty=200
fixed attempt 1 status summary: noauth=401 wrong=401 admin_empty=401 expected_admin_empty=401
fixed attempt 1 configured-password status=200
fixed attempt 2 status summary: noauth=401 wrong=401 admin_empty=401 expected_admin_empty=401
fixed attempt 2 configured-password status=200

Environment details captured:

• HTTP entrypoint: localhost TCP listener started by the ARM Anyka N1 service under qemu-arm.
• Service library: libNkN1API.a SHA-256 ecf4d713a16633e87d76cd178e509c70695d37bc6eb2947be8b3df5a21795aea.
• Anyka source commit: a5bece938ff0dc019ead3d62fa6adefbc8c497fe.
• Disclosure repository commit: 2554725f808a34e23a938b09b0f6db86c2adc01d.

Recommendations / Next Steps

• Do not ship a blank or universal default administrator password.
• Require a per-device random credential or setup-time password before exposing HTTP APIs.
• Remove reusable default credentials from companion apps.
• If a fallback account must exist for manufacturing, disable it in production firmware or gate it behind a physical setup process.
• Add regression tests that start the HTTP NetSDK service and assert that Authorization: Basic YWRtaW46 is rejected unless a user explicitly configured an empty password (which should itself be prohibited).
• Restrict sensitive factory APIs from normal production mode and segment network access to camera management services.

Additional Notes

The reproduction script was run twice consecutively and passed both times. It uses a faithful runtime execution of the real Anyka N1/anyka_ipc HTTP/NetSDK service code rather than a reimplemented handler. The limitation is that no physical JAIOTlink C492A-W6 device was attached in the sandbox; therefore the proof uses the original service library path and a controlled launcher to exercise the real authentication and NetSDK route logic over TCP.

No distinct same-root-cause bypass was confirmed for CVE-2026-58453. The variant search tested an alternate protected NetSDK entry point (/NetSDK/Network/interface/1) using the same default Basic credential (admin:) and compared it with a fixed-control configuration where the same Anyka N1/anyka_ipc HTTP service code was provisioned with a non-empty admin password. The alternate NetSDK path reproduced on the vulnerable/default configuration but failed with HTTP 401 on the fixed control, so it is an alternate protected endpoint on the vulnerable surface, not a bypass. Public/no-auth observations on /snapshot.jpg and /cgi-bin/gw2.cgi were excluded because they do not depend on the admin empty-password root cause.

Fix Coverage / Assumptions

The relevant fix invariant is: the HTTP user database must never contain a factory/default admin account with an empty password, and empty passwords should be rejected when loading or creating users. No official vendor patched firmware or upstream fix commit was available for testing, so the run used a behavioral fixed control that provisions admin with fixed-secret in the same service code.

The root-cause code path explicitly covered by this expected fix is:

• source/anyka_ipc/cloud/n1/src/n1_init.c, n1_usr_load().
• If /etc/jffs2/usr.conf cannot be opened, the tested source calls NK_N1Device_AddUser("admin", "", 0).
• If allocation fails while loading usr.conf, it repeats the same empty-password fallback.
• The NetSDK HTTP library then validates Basic credentials against that stored user database.

The runtime fixed control showed that changing the stored password covers at least two protected NetSDK routes:

• /NetSDK/System/deviceInfo
• /NetSDK/Network/interface/1

What the modeled fix does not cover: routes that are not protected by the same Basic-auth user database. The run observed no-auth HTTP 200 responses for /snapshot.jpg and /cgi-bin/gw2.cgi in the controlled harness, but these are not CVE-2026-58453 bypasses because they remain reachable without any use of admin: and therefore do not reach the same credential root cause.

Variant / Alternate Trigger

Tested candidates:

1. Baseline protected NetSDK path

   • Entrypoint: GET /NetSDK/System/deviceInfo
   • Credential: HTTP Basic admin:
   • Vulnerable result: HTTP 200 protected JSON.
   • Fixed-control result: HTTP 401 Unauthorized.
   • Assessment: baseline same-root behavior, fixed-control blocks it.

2. Alternate protected NetSDK path

   • Entrypoint: GET /NetSDK/Network/interface/1
   • Credential: HTTP Basic admin:
   • Vulnerable result: HTTP 200 protected network-interface JSON.
   • Fixed-control result: HTTP 401 Unauthorized.
   • Assessment: materially different endpoint on the vulnerable NetSDK surface, but not a bypass because the fixed control blocks the same empty credential.

3. Excluded snapshot path

   • Entrypoint: GET /snapshot.jpg
   • Credential: none.
   • Result: HTTP 200 in both vulnerable and fixed-control configurations.
   • Assessment: excluded from same-root variant claim. It does not depend on the empty admin password and may be public/harness-specific or a separate access-control issue.

4. Excluded legacy CGI information path

   • Entrypoint: GET /cgi-bin/gw2.cgi
   • Credential: none.
   • Result: HTTP 200 XML metadata in both vulnerable and fixed-control configurations.
   • Assessment: excluded from same-root variant claim. It is a separate legacy/public CGI surface, not a default-credential bypass.

Specific code paths involved:

• User provisioning: source/anyka_ipc/cloud/n1/src/n1_init.c::n1_usr_load().

• User insertion/checking sink: NK_N1Device_AddUser() and the NetSDK Basic-auth user lookup in libNkN1API.a.

• NetSDK route/auth strings in the library include Authorization, Basic realm="nkHTTP", N1_Device_HandleNetSDKHTTP, /NetSDK/System/deviceInfo, and /NetSDK/Network/interface/1.

• Package/component affected: JAIOTlink C492A-W6 firmware / Anyka N1 anyka_ipc HTTP service.

• Affected version as submitted: firmware 4.8.30.57701411.

• Runtime target tested: Anyka SmartCamera source/library commit a5bece938ff0dc019ead3d62fa6adefbc8c497fe, libNkN1API.a SHA-256 ecf4d713a16633e87d76cd178e509c70695d37bc6eb2947be8b3df5a21795aea, exercised through qemu-arm.

• Risk level and consequences: The parent issue remains critical where the default account is present: a network-adjacent attacker can authenticate with admin: and access protected NetSDK API resources. No additional bypass impact was demonstrated against the fixed-control configuration.

Impact Parity

• Disclosed/claimed maximum impact for parent: Network-adjacent authorization bypass/default credential access to camera snapshots, video streams, configuration, and factory APIs via HTTP Basic admin with an empty password.
• Reproduced impact from this variant run: The alternate NetSDK network-interface endpoint returned protected JSON with admin: on the vulnerable configuration. The same request returned HTTP 401 on the fixed-control configuration.
• Parity: none for bypass, because no same-root variant survived the fixed-control remediation. partial only as an alternate vulnerable-version endpoint demonstrating the same Basic-auth sink on another NetSDK route.
• Not demonstrated: No bypass of a non-empty-password fix, no physical device firmware update comparison, and no vendor patched firmware test because no fixed firmware/ref was available.

Root Cause

The root cause is still the factory/default user-loading behavior in n1_usr_load(): when the user config file is absent or cannot be processed, the service inserts admin with an empty password into the HTTP user database. The NetSDK HTTP handler accepts HTTP Basic Authorization: Basic YWRtaW46 because the stored password is also empty.

The alternate /NetSDK/Network/interface/1 path reaches the same Basic-auth sink as /NetSDK/System/deviceInfo, which is why it succeeds on the vulnerable configuration. However, this shared sink also means the expected fix is effective: once the stored admin password is non-empty, both paths reject admin: with HTTP 401.

No official fix commit is known.

Reproduction Steps

1. Run bundle/vuln_variant/reproduction_steps.sh.
2. The script:
   • Reuses/clones the disclosure repository and the Anyka SmartCamera source.
   • Builds an ARM launcher that links the real Anyka N1 libNkN1API.a, libNkUtils.a, and libbase.a libraries.
   • Starts the service under qemu-arm twice: first with admin provisioned with an empty password, then with admin provisioned with fixed-secret.
   • Sends the same candidate HTTP requests to both targets.
   • Records structured candidate results in bundle/vuln_variant/candidate_results.jsonl and logs under bundle/logs/vuln_variant/.
3. Expected evidence:
   • Vulnerable target: admin: gets HTTP 200 on /NetSDK/System/deviceInfo and /NetSDK/Network/interface/1.
   • Fixed-control target: admin: gets HTTP 401 on both NetSDK paths, while admin:fixed-secret gets HTTP 200 on /NetSDK/System/deviceInfo.
   • Script exits 1 because no fixed-control bypass was confirmed; this is the expected negative variant verdict.

Evidence

Primary evidence:

• bundle/logs/vuln_variant/reproduction_steps.log — full variant run transcript.
• bundle/vuln_variant/candidate_results.jsonl — structured per-candidate results.
• bundle/vuln_variant/runtime_manifest.json — runtime execution details and candidate summary.
• bundle/vuln_variant/source_identity.json — tested source/library identity.
• bundle/vuln_variant/patch_analysis.md — detailed fix coverage and rule-out matrix.

Key excerpts from the verified script run:

vulnerable c1_netsdk_deviceinfo_admin_empty ... auth=admin: http_code=200 bytes=251
vulnerable c2_netsdk_network_admin_empty ... auth=admin: http_code=200 bytes=510
fixed_control c1_netsdk_deviceinfo_admin_empty ... auth=admin: http_code=401 bytes=130
fixed_control c2_netsdk_network_admin_empty ... auth=admin: http_code=401 bytes=132
fixed_control control_configured_password ... auth=admin:fixed-secret http_code=200 bytes=251
=== NO CONFIRMED VARIANT/BYPASS ... ===

Excluded-surface evidence:

vulnerable c3_snapshot_noauth_exclusion ... auth=<none> http_code=200
fixed_control c3_snapshot_noauth_exclusion ... auth=<none> http_code=200
vulnerable c4_legacy_gw2_noauth_exclusion ... auth=<none> http_code=200
fixed_control c4_legacy_gw2_noauth_exclusion ... auth=<none> http_code=200

These were not claimed as CVE-2026-58453 variants because they do not use the empty admin password.

Environment details captured:

• SmartCamera source commit: a5bece938ff0dc019ead3d62fa6adefbc8c497fe.
• Disclosure repository commit: 2554725f808a34e23a938b09b0f6db86c2adc01d.
• libNkN1API.a SHA-256: ecf4d713a16633e87d76cd178e509c70695d37bc6eb2947be8b3df5a21795aea.
• Runtime stack: qemu-arm executing the ARM Anyka N1 HTTP service libraries.

Recommendations / Next Steps

• Remove the NK_N1Device_AddUser("admin", "", 0) fallback from every factory/error path.
• Reject empty passwords when loading usr.conf, creating users, or changing user credentials.
• Require a per-device random password or physical/setup-time provisioning before enabling remote HTTP APIs.
• Add regression tests that start the HTTP service and assert admin: is rejected on every protected NetSDK route, including /NetSDK/System/deviceInfo, /NetSDK/Network/interface/1, video configuration routes, and factory routes.
• Separately review no-auth/public routes such as /snapshot.jpg and /cgi-bin/gw2.cgi against the product security model. If they are intended to be private, protect them with the same non-empty credential policy; however, treat that as a separate access-control hardening task, not a bypass of the default-credential fix.

Additional Notes

The variant script was run twice successfully and was idempotent. Both executions completed without crashing and exited 1, which is the encoded result for “no variant/bypass reproduced on the fixed-control target.”

No SECURITY.md or vendor threat model was found in the cached source/disclosure repositories. The analysis therefore used the ticket’s network-adjacent HTTP trust boundary and the disclosure repository’s controlled-lab scope note. No physical JAIOTlink camera or vendor fixed firmware image was available in this sandbox.