CISA warns of critical flaws in EseeCloud IP‑camera firmware and app

CISA issued an advisory on October 15, 2026, warning of three critical vulnerabilities in Guangzhou Juan IoT Technology’s EseeCloud IP-camera firmware and app, rated CVSS 9.8.

The flaws affect EseeCloud App versions ≤4.9.6 and Firmware ≤4.9.86.0, letting attackers gain full control of devices. The vulnerabilities include hard-coded credentials (CVE-2026-107617), improperly controlled modification of object attributes (CVE-2026-97858), and observable response discrepancies (CVE-2026-105664).

Hard-coded credentials allow attackers to log in to any affected device without authentication. CVE-2026-97858 enables attackers to unbind a device from its legitimate owner and rebind it to their own account, stealing the device’s full serial ID. CVE-2026-105664 exposes an observable response discrepancy, allowing attackers to identify valid device IDs at scale by detecting differences in error responses.

EseeCloud devices are deployed worldwide in critical infrastructure sectors, including energy, communications, transportation, financial services, and government facilities. Guangzhou Juan IoT Technology’s devices are frequently white-labeled or rebranded, making identification difficult without checking for EseeCloud app usage or network traffic to eseecloud.app domains.

Guangzhou Juan IoT Technology did not respond to CISA’s coordination attempts, leaving users without an official patch. As of October 15, 2026, no known public exploitation of these vulnerabilities has been reported to CISA.

The vulnerabilities could enable attackers to conduct persistent surveillance, lateral reconnaissance, and sabotage in critical infrastructure environments. CISA recommends minimizing network exposure for control system devices, isolating them behind firewalls, and using secure remote access methods like VPNs.

CISA advises organizations to perform impact analysis and risk assessments before deploying defensive measures and to report suspected malicious activity to CISA. Security experts recommend treating unpatchable EseeCloud devices as inherently untrusted, accelerating replacement planning, and implementing network-level controls like firewall rules and DNS filtering. Security Arsenal provides Sigma rules and detection strategies for identifying EseeCloud authentication enumeration, outbound connections to unusual destinations, and inbound connection attempts from the internet.

These are not minor bugs – they represent a systemic failure of the device's authentication and ownership model.

Shield53 Insights, Shield53 Insights