CVE-2026-85478

The CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface (a hardware debug port on the device) with no authentication required, as classified under CWE-306. An attacker who can physically open or reach the device can interrupt the normal boot process and use the bootloader to inspect or modify boot configuration, firmware data, and the software the camera loads. Impact is limited to attackers with hands-on access, which is why the CVSS 4.0 score is low (2.4, AV:P), but a successful attack could enable firmware tampering or persistent modification of the device's software. Only CM2507 cameras running the cited firmware version are identified as affected. There is no evidence of exploitation in the wild, no public proof-of-concept, and the issue is not listed in CISA's KEV catalog.

What to do: Check with CareCam for a firmware release newer than HMT.CM2507 v251211.1507 that disables or protects the debug bootloader, and apply it when available. In the meantime, restrict physical access to deployed cameras (locked enclosures, controlled premises), inspect units in high-risk or tamper-prone locations for signs of opening, and treat any camera that has left your custody as potentially modified until its firmware is verified or reflashed.