CVE-2026-85497

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash with insufficient computational effort (CWE-916), leaving it vulnerable to offline cracking. The flaw is triggered when an attacker obtains the firmware image or the device's password database and then attacks the static hash offline; because the hash is fixed across the product line, the recovered root credential may be reusable on other devices running the same firmware. Successful cracking yields full root access to the camera, enabling theft of video footage, device reconfiguration, or conscription into botnets, consistent with the critical CVSS 4.0 score of 9.3. Any CM2507 deployment is affected, particularly consumer and small-business installations that use default or reused credentials. The issue is not listed in CISA's KEV catalog and no public proof-of-concept is known; the CVE was assigned by CISA ICS-CERT.

What to do: Check with CareCam for updated firmware that replaces the legacy hash and upgrade as soon as a fixed release is published (no fixed version is identified in the available data). In the meantime, set strong, unique root/administrator passwords on each camera and on any other device running the same firmware, and do not expose the camera's management interface directly to the internet. Place cameras on an isolated network segment reachable only via VPN and review device logs for unexpected successful logins.