Critical Vulnerabilities in Guangzhou Juan IoT Technology EseeCloud

Guangzhou Juan IoT Technology EseeCloud products, including the EseeCloud App (versions <=4.9.6) and EseeCloud Firmware (versions <=4.9.86.0), are affected by three severe vulnerabilities (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664). These flaws expose IP cameras to complete remote compromise. The vulnerabilities include the use of hard-coded credentials, a flaw allowing unauthorized modification of object attributes that enables device rebinding, and an enumeration oracle created by observable response discrepancies. Because the vendor has not responded to CISA coordination attempts, no official patches are currently available. These devices are widely deployed across energy, communications, transportation, financial, and government sectors, presenting a significant risk of large-scale IoT botnet recruitment or unauthorized surveillance.

Attack Chain

1. An attacker identifies target EseeCloud devices via internet-wide scanning or OSINT discovery.
2. The attacker uses the enumeration oracle (CVE-2026-105664) by sending repeated API requests with incrementing ID values to identify valid, registered device IDs.
3. The attacker observes the response discrepancies (error codes) to filter out nonexistent IDs from the 10-digit numeric search space.
4. The attacker leverages the hard-coded credentials (CVE-2026-107617) to bypass standard authentication mechanisms.
5. The attacker issues a malicious request to the management API to unbind the target camera from the legitimate owner (CVE-2026-97858).
6. The attacker binds the target camera to an account under their control by exploiting improper attribute modification (CVE-2026-97858).
7. The attacker gains full control over the camera, including the ability to stream video, modify settings, or integrate the device into a botnet.

Impact

Successful exploitation results in total loss of device integrity and confidentiality. Attackers can hijack existing EseeCloud IP cameras, potentially leading to unauthorized real-time surveillance of sensitive environments or the integration of thousands of cameras into distributed denial-of-service (DDoS) botnets. These vulnerabilities affect critical infrastructure sectors including energy, finance, and government, with deployment reported on a global scale.

Recommendation

Prioritized, concrete actions for security operations:

• Network administrators should identify and isolate EseeCloud devices from the public internet using firewalls or dedicated IoT VLANs to prevent direct reachability.
• Monitor ingress traffic to management endpoints for high-frequency sequences of API requests that may indicate enumeration activity against device ID spaces (CVE-2026-105664).
• Since no patch is available, organizations should evaluate the business necessity of these devices and consider transitioning to supported, hardened hardware if potential exposure to these CVEs presents an unacceptable risk.
• Block access to the EseeCloud mobile/API traffic at the perimeter for non-essential use cases to mitigate the risk of unauthorized device rebinding.