Hard-coded Bootloader Credentials in CareCam Pro IP Cameras

CISA has released an advisory regarding a critical security vulnerability in CareCam Pro IP Cameras, specifically model ANJIA AJL33PC0801. The device firmware (linux_linux_202008261138_svn13796) and bootloader (U-Boot 2010.06 compiled 2020-08-26) contain hard-coded credentials that grant unauthorized access to the bootloader interface. This vulnerability, identified as CVE-2026-85083, requires an attacker to have physical access to the device to exploit the flaw. Once access is gained, an attacker can bypass authentication, modify firmware, and alter system configurations, leading to a complete compromise of the IP camera. CareCam has not provided a response or a patch for this issue. Given the nature of the vulnerability being tied to physical access, defenders should prioritize physical security and network isolation for these assets.

Impact

Successful exploitation results in full device compromise, allowing an attacker to gain persistent, privileged control over the camera. This impact is significant as IP cameras are frequently deployed in commercial facilities and, if compromised, can serve as a persistent foothold within an internal network or be used for unauthorized surveillance. No in-the-wild exploitation has been reported to CISA at this time.

Recommendation

Prioritize physical access controls and network segmentation to mitigate the risk posed by this vulnerability.

• Isolate all CareCam Pro IP cameras on restricted VLANs with no direct internet access to prevent the device from becoming a pivot point following a physical breach.
• Implement strict physical security measures for all deployments of ANJIA AJL33PC0801 hardware to prevent unauthorized local access to the bootloader interface.
• Monitor network traffic for anomalous outbound connections originating from IoT segments, as compromised devices may attempt to establish unauthorized C2 communications.
• If remote access to these devices is necessary, mandate the use of secure, authenticated VPNs rather than exposing the camera interface directly to the internet.