Girafit Camera App

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:girafit:girafit_camera_app:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorGirafit (7bfa536a-c95b-5d2b-9b87-6a1f58ecb7aa)
ProductGirafit Camera App (74a7cdf9-f310-5988-a29e-c2d7e69a6b2a)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-53986 vulnerable 2026-11-03 10:17:29.327420 Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure
MEDIUM (5.3)
Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device, potentially enabling tracking, impersonation, or further exploitation if combined with the TURN relay password.
Published: 2026-10-21T16:59:57.188Z
Updated: 2026-10-21T19:52:14.331Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.