{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/eseecloud-firmware-4.9.86.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EseeCloud App (\u003c=4.9.6)","EseeCloud Firmware (\u003c=4.9.86.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Guangzhou Juan IoT Technology Co., Ltd."],"content_html":"\u003cp\u003eGuangzhou Juan IoT Technology EseeCloud products, including the EseeCloud App (versions \u0026lt;=4.9.6) and EseeCloud Firmware (versions \u0026lt;=4.9.86.0), are affected by three severe vulnerabilities (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664). These flaws expose IP cameras to complete remote compromise. The vulnerabilities include the use of hard-coded credentials, a flaw allowing unauthorized modification of object attributes that enables device rebinding, and an enumeration oracle created by observable response discrepancies. Because the vendor has not responded to CISA coordination attempts, no official patches are currently available. These devices are widely deployed across energy, communications, transportation, financial, and government sectors, presenting a significant risk of large-scale IoT botnet recruitment or unauthorized surveillance.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies target EseeCloud devices via internet-wide scanning or OSINT discovery.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the enumeration oracle (CVE-2026-105664) by sending repeated API requests with incrementing ID values to identify valid, registered device IDs.\u003c/li\u003e\n\u003cli\u003eThe attacker observes the response discrepancies (error codes) to filter out nonexistent IDs from the 10-digit numeric search space.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the hard-coded credentials (CVE-2026-107617) to bypass standard authentication mechanisms.\u003c/li\u003e\n\u003cli\u003eThe attacker issues a malicious request to the management API to unbind the target camera from the legitimate owner (CVE-2026-97858).\u003c/li\u003e\n\u003cli\u003eThe attacker binds the target camera to an account under their control by exploiting improper attribute modification (CVE-2026-97858).\u003c/li\u003e\n\u003cli\u003eThe attacker gains full control over the camera, including the ability to stream video, modify settings, or integrate the device into a botnet.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in total loss of device integrity and confidentiality. Attackers can hijack existing EseeCloud IP cameras, potentially leading to unauthorized real-time surveillance of sensitive environments or the integration of thousands of cameras into distributed denial-of-service (DDoS) botnets. These vulnerabilities affect critical infrastructure sectors including energy, finance, and government, with deployment reported on a global scale.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for security operations:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eNetwork administrators should identify and isolate EseeCloud devices from the public internet using firewalls or dedicated IoT VLANs to prevent direct reachability.\u003c/li\u003e\n\u003cli\u003eMonitor ingress traffic to management endpoints for high-frequency sequences of API requests that may indicate enumeration activity against device ID spaces (CVE-2026-105664).\u003c/li\u003e\n\u003cli\u003eSince no patch is available, organizations should evaluate the business necessity of these devices and consider transitioning to supported, hardened hardware if potential exposure to these CVEs presents an unacceptable risk.\u003c/li\u003e\n\u003cli\u003eBlock access to the EseeCloud mobile/API traffic at the perimeter for non-essential use cases to mitigate the risk of unauthorized device rebinding.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T17:00:33Z","date_published":"2026-10-15T17:00:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-eseecloud-vulnerabilities/","summary":"Multiple critical vulnerabilities in EseeCloud App and firmware allow remote, unauthenticated attackers to gain device control, perform unauthorized device rebinding, and perform bulk enumeration of registered IoT cameras.","title":"Critical Vulnerabilities in Guangzhou Juan IoT Technology EseeCloud","url":"https://feed.craftedsignal.io/briefs/2026-10-eseecloud-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - EseeCloud Firmware (\u003c=4.9.86.0)","version":"https://jsonfeed.org/version/1.1"}