CVE-2026-84400

CVE-2026-84400 is a missing-authentication flaw (CWE-306) in the network maintenance mechanism of CareCam CM2507 IP cameras, which can be abused to activate a remote debugging service. To trigger it, an attacker must already be on the same local network as the camera and the device must be in a specific state; no privileges or user interaction are required. If successful, the attacker can make the debugging service remotely accessible, increasing the risk of unauthorized administrative access, although the CVSS 4.0 score is low (2.3), with no confidentiality impact and only a low integrity impact. Any deployment of the CM2507 camera, typically in consumer or small-site installations, is affected. No exploitation in the wild, public proof of concept, or KEV listing is known.

What to do: Check with CareCam for updated CM2507 firmware and apply it as soon as a fixed version is published (none is specified in the available data). In the meantime, keep these cameras on a segmented network or VLAN separated from untrusted clients and disable any remote-administration or P2P access features that are not needed. If the model is no longer receiving firmware updates, monitor for the camera unexpectedly exposing a debugging service or consider replacing the device.