CVE-2026-47096

MEDIUM 6.1

AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamID_SystemName value through the /config?action=set web configuration API. Attackers can exploit this flaw when device authentication is disabled to persistently execute arbitrary script in the browser of any administrator who opens the web management interface, enabling theft of stored secrets such as web UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials, as well as hijacking of the authenticated session.

CWE	CWE-79
Vendor	aja video systems
Product	helo plus
Published	Sep 30, 2026

Stay Ahead of the Next One

Get instant alerts for aja video systems helo plus

Be the first to know when new medium vulnerabilities affecting aja video systems helo plus are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

AJA Video Systems / HELO Plus

0 < 2.1.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

aja.com: https://www.aja.com/security-advisories/aja-sa-2026-003 d26ddnfpy9hzf8.cloudfront.net: https://d26ddnfpy9hzf8.cloudfront.net/aja-web/public/pdf/2026/AJA_HELO_PLUS_ReleaseNotes_v2.1.7.pdf aja.com: https://www.aja.com/support/item/10457 vulncheck.com: https://www.vulncheck.com/advisories/aja-helo-plus-stored-xss-via-system-name-parameter

Credits

Saleh Alghamdi Abdulrahman Aldossary