Guangzhou Juan IoT Technology EseeCloud
Unpatched EseeCloud flaws, including hard-coded credentials, could let attackers take over IP cameras.
71
Vulnerability3 · 2 reads
CVE-2026-107617
Hard-coded login credential in EseeCloud devices
- CVSS 4.0
- 9.3 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-107617 is a critical hard-coded credential flaw (CWE-798) in EseeCloud devices from Guangzhou Juan IoT Technology. An unauthenticated remote attacker can log in using a credential embedded in the product, with no user interaction required. Successful login gives high impact to confidentiality, integrity, and availability of the device itself (CVSS 4.0 9.3). Affected version ranges are not stated in the published record. CISA has not listed the issue in the Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Treat any internet-reachable EseeCloud device as compromised until the vendor issues a firmware fix that removes the hard-coded credential and forces a unique credential. Isolate cameras and recorders from the internet, disable remote cloud login where possible, change any user-set passwords, and watch vendor/ICS-CERT advisories for a patched build; no fixed version is identified in the published data.
| Product | Affected |
|---|---|
| Guangzhou Juan IoT Technology EseeCloud | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An attacker can use a hard-coded credential to log in to EseeCloud devices.
- Weakness
- CWE-798
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X