JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to ga…

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware version 4.8.30.57701411 are affected by a hard-coded credentials vulnerability (CVE-2026-58453). The vulnerability allows network-adjacent attackers to authenticate using the default admin username with an empty password via the anyka_ipc HTTP service on port 80. Once authenticated, attackers can access sensitive resources including camera snapshots, live video streams, and network configuration settings. Additionally, attackers can reach factory-level API endpoints, notably the SetMAC command, which exposes a command injection surface. The vulnerability requires no special tools or credentials beyond the known defaults, making exploitation trivial for anyone on the same network. This issue is particularly concerning for home and small business users who may deploy these cameras without additional network segmentation. The vulnerability has been documented with public writeups and is listed on multiple advisory platforms including NVD and VulnCheck.