Guangzhou Juan IoT Technology EseeCloud
Unpatched EseeCloud flaws, including hard-coded credentials, could let attackers take over IP cameras.
71
Vulnerability3 · 2 reads
CVE-2026-105664
Device ID enumeration oracle in Guangzhou Juan EseeCloud
- CVSS 4.0
- 6.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-105664 is an observable response discrepancy (CWE-204) in Guangzhou Juan IoT Technology’s EseeCloud service. An endpoint returns a different error code for a nonexistent ID than for a valid, registered ID, so anyone with a valid access token—but no further authorization—can tell which 10-digit IDs are real. With no meaningful rate limiting, that difference is an enumeration oracle that can be used to discover registered devices at scale. The issue is scored CVSS 4.0 6.9 (medium), confidentiality impact only; affected versions are not stated. It is not on CISA’s KEV list, and no public proof-of-concept is known.
What to do: Treat device identifiers as sensitive: require authorization beyond a generic access token, return identical status codes and bodies for valid and invalid IDs, and enforce strict rate limits and anomaly detection on this endpoint. Until Guangzhou Juan publishes a fix, monitor EseeCloud API logs for high-volume ID probing and restrict tokens that can call the endpoint. No patched version is identified in the advisory data, so confirm remediation directly with the vendor.
| Product | Affected |
|---|---|
| Guangzhou Juan IoT Technology EseeCloud | — |
Estimated exposure
massOn the order of millions of registered camera/IoT devices plausibly reachable via EseeCloud (not a measured count) — Estimate only: EseeCloud is a widely deployed white-label cloud backend for low-cost consumer IP cameras, commonly associated with large device populations, but this advisory gives no install count, version range, or public scan total.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization - to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale.
- Weakness
- CWE-204
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X