An exploitable authentication bypass vulnerability exists in the Bluetooth Low Energy (BLE) authentication module of YI M1 Mirrorless Camera V3.2-cn. An attacker can send a set of BLE commands to trigger this vulnerability, resulting in sensitive data leakage (e.g., personal photos). An attacker can also control the camera to record or take a picture after bypassing authentication.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Yi_m1_mirrorless_camera_firmware | Xiaoyi | 3.2-cn (including) | 3.2-cn (including) |