CVE-2026-81305

The CareCam CM2507 IP camera automatically runs a predetermined script from removable media without verifying its authenticity or integrity, a flaw tracked as CWE-829 (inclusion of functionality from an untrusted control sphere). An attacker with physical access to the device can insert removable media containing a malicious script at the expected path, which the camera then executes automatically. Successful exploitation yields arbitrary code execution in the security context of the camera, giving the attacker full control of the device, including its video/audio functions and any network reach it has. All deployments of the CM2507 model are potentially affected, but the disclosure does not specify firmware versions or a fixed release. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Until a firmware fix is published, restrict physical access to camera enclosures, avoid inserting untrusted removable media (e.g., SD cards), and remove any media from devices in sensitive locations. Monitor the CISA ICS-CERT advisory and CareCam vendor channels for a patched firmware release, and consider segmenting cameras on an isolated VLAN as defense in depth.