CISA flags critical hard-coded credential flaw in EseeCloud IP cameras; vendor unresponsive
CISA has published an advisory on three vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud IP camera app and firmware, one rated 9.8 critical. The flaws allow full device takeover, unauthorised rebinding and large-scale device enumeration. The vendor did not respond to CISA's coordination attempts, so no fix exists and the only remedy is network isolation.
- CVE-2026-107617 lets an attacker use a hard-coded credential to log in to EseeCloud devices, rated CVSS v3.1 9.8 critical.
- CVE-2026-97858 allows the server to unbind a device from its owner and rebind it to an attacker's account, exposing the device's full serial ID.
- CVE-2026-105664 creates an enumeration oracle, letting an attacker with a valid token discover registered devices across a 10-digit search space absent rate limiting.
- Guangzhou Juan IoT Technology did not respond to CISA's coordination attempts, so no patch is available and CISA advises network isolation.
- Affected equipment is deployed worldwide across energy, communications, transportation, financial services and government sectors.