CVE-2026-81321

The CareCam CM2507 IP camera stores its configured wireless network identifier (SSID) and pre-shared key in cleartext on the device filesystem rather than in encrypted form (CWE-312). Exploitation requires the attacker to first obtain filesystem access, which can be achieved through physical access to the device, an exposed debugging interface (such as a serial console), or by chaining a separate vulnerability that grants file read access. Once the filesystem is readable, the attacker recovers the Wi-Fi credentials in full, allowing them to join the victim's wireless network and potentially pivot to other connected devices. All deployments of the CM2507 are affected because the credential handling is inherent to the firmware, not an optional misconfiguration. No public proof-of-concept exists, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported to date.

What to do: Physically secure installed CM2507 cameras, close or disable any unused debug/serial interfaces, and place the cameras on a segregated guest or IoT VLAN so recovered Wi-Fi credentials grant only limited network access. If a camera is ever lost, stolen, or decommissioned, rotate the Wi-Fi pre-shared key, since the device stores it in plaintext. Monitor the vendor and CISA ICS-CERT for a firmware update that encrypts credential storage and apply it when released.