CareCam Pro IP Cameras
CISA advisory details hard-coded bootloader credential CVE-2026-85083 in ANJIA AJL33PC0801 CareCam Pro cameras, allowing physical-access firmware compromise.
CISA ICS advisory ICSA-26-251-01 describes CVE-2026-85083, a hard-coded credential (CWE-798) used for bootloader authentication in the ANJIA AJL33PC0801 CareCam Pro IP camera. An attacker with physical access could gain privileged bootloader access and modify firmware and configuration, potentially fully compromising the device. The flaw scores 6.8 on CVSS 3.1 (7.0 on CVSS 4.0), is not remotely exploitable, and no public exploitation has been reported. Affected firmware is linux_linux_202008261138_svn13796 with U-Boot 2010.06; the vendor is headquartered in China with worldwide deployments.
- Hard-coded credential (CWE-798) grants privileged bootloader access to anyone with physical device access.
- Could enable firmware and configuration modification, potentially resulting in complete device compromise.
- CVSS 3.1 score 6.8; not remotely exploitable and no known public exploitation reported.
- CISA recommends minimizing network exposure and using secure remote access methods.
- CVEs
- CVE-2026-85083
- Products
- CareCam Pro IP Camera
- Organizations
- CISA
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85083 | Hard-Coded Bootloader Credential in ANJIA AJL33PC0801 IP Camera | 7.0 | — |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to take full control of the device. The following versions of CareCam Pro IP Cameras are affected: ANJIA AJL33PC0801 Firmware linux_linux_202008261138_svn13796_/_Bootloader_U-Boot_2010. 06_compiled_2020-08-26 (CVE-2026-85083) CVSS Vendor Equipment Vulnerabilities v3 6.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.