Information Disclosure Vulnerability in AJA HELO Plus Firmware

CVE-2026-47097

What is CVE-2026-47097?

The AJA HELO Plus firmware prior to version 2.1.7 exhibits an information disclosure flaw that allows unauthenticated attackers to decrypt sensitive diagnostic exports. This is achieved by exploiting a static AES passphrase embedded in an obfuscated format within the affected firmware. Attackers can reverse engineer the firmware image, available publicly, to unveil the shared passphrase. With this passphrase, they can access and decrypt diagnostic bundles from an unauthenticated diagnostics endpoint, potentially exposing critical server information that could compromise the integrity and security of the system.

References