CVE-2026-97858

CVE-2026-97858 is an improper control of dynamically determined object attributes (CWE-915) in Guangzhou Juan IoT Technology’s EseeCloud service. A remote attacker who needs no privileges and no user interaction can make the server unbind a target device from its current owner and rebind it to the attacker’s account, even when the device is already bound to someone else. That takeover also exposes the device’s full serial ID (CVSS 4.0 base 6.9, confidentiality impact rated low on the vulnerable system). Consumer and other IoT devices managed through EseeCloud are in scope; the advisory data does not name fixed or affected version ranges. CISA has not listed the CVE in the KEV catalog, and no public proof-of-concept is known.

What to do: Treat device-to-account bindings as untrusted until the vendor publishes a fix: review EseeCloud ownership for unexpected unbind/rebind events, rotate or re-bind devices only from the legitimate owner account, and apply the Guangzhou Juan / CISA ICS advisory update as soon as a patched release is identified. Until then, limit which accounts can reach the cloud binding service and alert on ownership changes and serial-ID lookups for cameras and other devices managed through EseeCloud.