CISA flags critical hard-coded credential flaw in EseeCloud IP cameras; vendor unresponsive

CISA has published an advisory on three vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud IP camera app and firmware, one rated 9.8 critical. The flaws allow full device takeover, unauthorised rebinding and large-scale device enumeration. The vendor did not respond to CISA's coordination attempts, so no fix exists and the only remedy is network isolation.

• CVE-2026-107617 lets an attacker use a hard-coded credential to log in to EseeCloud devices, rated CVSS v3.1 9.8 critical.
• CVE-2026-97858 allows the server to unbind a device from its owner and rebind it to an attacker's account, exposing the device's full serial ID.
• CVE-2026-105664 creates an enumeration oracle, letting an attacker with a valid token discover registered devices across a 10-digit search space absent rate limiting.
• Guangzhou Juan IoT Technology did not respond to CISA's coordination attempts, so no patch is available and CISA advises network isolation.
• Affected equipment is deployed worldwide across energy, communications, transportation, financial services and government sectors.

Executive summary

CISA's advisory ICSA-26-288-02, released October 15, 2026, covers three vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud product line. The affected versions are EseeCloud App <=4.9.6 and EseeCloud Firmware <=4.9.86.0, with all three CVEs present in both. CISA states that successful…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.