CVE-2026-58453 is a critical flaw (CVSS 9.8) in JAIOTlink C492A-W6 Wi-Fi IP cameras on firmware 4.8.30.57701411. The anyka_ipc HTTP service on port 80 accepts the default admin username with an empty password. The record names no fix, so isolate or replace the device.
What's affected
- JAIOTlink C492A-W6 Wi-Fi IP cameras, firmware 4.8.30.57701411.
- Fixed version: none named in the record.
How to check if you're exposed
Check the camera firmware version in its app or web interface. Then check from a machine on the same network whether the web service on port 80 answers with a login prompt, and whether your router exposes it to the internet.
Firmware is outside what a code scan covers, but the Gold directory is a quick way to look up the CVE record and the weakness class when you write the change ticket.
What to do now
- Contact the vendor for a firmware update.
- Place the camera on an isolated network segment with no internet inbound access.
- Block port 80 from untrusted networks.
- Replace the camera if no fix appears.
Keep a short list of every device of this model on your network, with its firmware version and where it sits. Embedded gear is easy to forget, and a list is what lets you act quickly when a vendor ships an update.
Why it matters
The class is CWE-1392 (Use of Default Credentials). A built-in account with no password cannot be removed by the owner. The record says attackers can then see snapshots and video streams, read network configuration, and reach factory level API endpoints.
The CISA KEV flag is false. A VulnCheck advisory and a researcher writeup are the sources.
The record cites a researcher writeup that describes how the credentials were found by reading the vendor Android app. That detail matters for defenders because it shows the flaw is easy to rediscover once you know to look, so assume anyone on the same network can find it.
Quick check
The record says network-adjacent. Does that mean internet exposed?
Not by itself. It means an attacker on the same network. Check whether the device is also reachable from outside.
Sources
Last reviewed: 19 October 2026.
