CVE-2026-88259

CareCam CM2507 IP cameras expose their network video streaming service without requiring any authentication (CWE-306: Missing Authentication for Critical Function). An unauthenticated attacker with network reachability to the device — for example from the local network or from the internet where the camera is exposed through port forwarding or similar configuration — can connect to the streaming service and watch live camera video without credentials or user interaction. Per the CVSS 4.0 vector (VC:H, no integrity or availability impact), the attacker gains full visibility of the live feed but the flaw does not by itself alter video or disrupt the camera. All deployments of the CM2507 model are affected; no specific firmware version range was provided in the available data. As of the advisory, exploitation in the wild is not documented, no public proof-of-concept is known, and the CVE was assigned by CISA ICS-CERT.

What to do: Restrict network access to the camera's video streaming service (firewall rules, VLAN segmentation) and avoid exposing it directly to the internet; use a VPN for remote viewing if needed. Contact the vendor for a firmware update that adds authentication, since no fixed version is specified in the data. Review network logs for connections to the camera from unrecognized clients.