High severity · published Sep 9, 2026
CVE-2026-77974
Softish C6 Ear Camera and EarVision Android Application Missing authentication for critical function
8.0
CVSS
0.3%
EPSS
No
On KEV
Description
After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
C6 Ear Camera · Softish
1.3.1_Code 132 · source: vendor
EA
EarVision Android application · Softish
1.3.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77974
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77974
raw.githubusercontent.com
https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-251-01.json
More from C6 Ear Camera
8.8
CVE-2026-81640
Softish C6 Ear Camera and EarVision Android Application Use of Hard-coded Credentials
7.6
CVE-2026-82563
Softish C6 Ear Camera and EarVision Android Application Authentication bypass by spoofing
6.5
CVE-2026-81330
Softish C6 Ear Camera and EarVision Android Application Cleartext transmission of sensitive information