CVE-2026-84398

CareCam CM2507 IP cameras contain a privileged account, reachable through the ONVIF management service, that accepts an empty password (CWE-258), meaning no real authentication is required to use it. An attacker with network access to the device's ONVIF interface can authenticate with the blank password and invoke privileged management functions, obtaining device information, user details, media profiles, and stream configuration. The CVSS 4.0 vector shows network attack vector with no privileges or user interaction required and high confidentiality impact, with no integrity or availability impact on the device. Any CM2507 whose ONVIF service is reachable — including units port-forwarded to the internet or exposed on shared networks — is affected. The issue is not currently in CISA's KEV catalog and no public proof-of-concept or in-the-wild exploitation has been reported.

What to do: Restrict network access to the camera's ONVIF management service (typically HTTP port 80) to trusted hosts or a VPN, avoid direct port forwarding, and ensure strong non-empty passwords are set on all camera accounts. Check CareCam and the CISA ICS-CERT advisory for fixed firmware and update when available; review device, user, and media-profile settings for signs of unauthorized access or changes.