CVE-2026-58453 describes a hard-coded credentials vulnerability in JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411. The anyka_ipc HTTP service on port 80 accepts the default admin username with no password, allowing unauthenticated network-adjacent attackers to gain full access to sensitive camera functions. This includes viewing snapshots and video streams, modifying network settings, and exploiting factory-level API endpoints such as the SetMAC command injection surface. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity. No official patch or remediation guidance is currently provided by the vendor.

Attackers can gain unauthorized administrative access to the affected camera without credentials, enabling them to view live and recorded video, access snapshots, alter network configurations, and potentially execute commands via the factory-level API. This compromises confidentiality, integrity, and availability of the device and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the camera's HTTP service (port 80) to trusted users only. Consider isolating the device on a separate network segment to limit exposure. Change default credentials if possible and monitor for unusual activity.