CVE-2026-47097

{
  "etk_id": "ETK-2026-172",
  "cve_id": "CVE-2026-47097",
  "display_id": "CVE-2026-47097",
  "ghsa_id": "GHSA-pp2h-qx3j-9gxh",
  "euvd_id": "EUVD-2026-89967",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated diagnostic bundle disclosure in AJA HELO Plus",
  "summary": "AJA HELO Plus devices running firmware earlier than 2.1.7 may expose diagnostic bundles containing sensitive system information. An unauthenticated attacker can retrieve and decrypt those bundles where the device's diagnostics endpoint is reachable.",
  "mitigation": "Upgrade AJA HELO Plus firmware to version 2.1.7 or later. Until upgrades are complete, restrict unauthenticated access to the diagnostics endpoint and limit network reachability to trusted administrators.",
  "vendor": "AJA Video Systems",
  "product": "HELO Plus",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.1.7"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.1.7"
      ],
      "package_name": "HELO Plus",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0038,
  "epss_percentile": 0.308,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 68.6385399,
  "t0_at": "2026-09-30T14:31:11.797000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-30T14:31:11.797000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T14:31:11.797000+00:00",
      "url": "https://github.com/advisories/GHSA-pp2h-qx3j-9gxh"
    }
  }
}