Guangzhou Juan IoT Technology EseeCloud
Unpatched EseeCloud flaws, including hard-coded credentials, could let attackers take over IP cameras.
CISA reports three vulnerabilities in Guangzhou Juan IoT Technology EseeCloud App versions through 4.9.6 and firmware through 4.9.86.0 that could give an attacker control of affected IP cameras. CVE-2026-107617 is a hard-coded credential issue scored CVSS 9.8. CVE-2026-97858 can unbind a device from its owner and rebind it, while CVE-2026-105664 is an ID enumeration oracle. The vendor did not respond to CISA, and users are told to contact the company for support.
- Hard-coded credential CVE-2026-107617 is scored CVSS 9.8.
- CVE-2026-97858 can unbind a device and rebind it to another account.
- CVE-2026-105664 exposes an ID enumeration oracle without meaningful rate limits.
- The vendor did not respond to CISA, and no patch is listed.
- EseeCloud App through 4.9.6 and firmware through 4.9.86.0 are affected.
- Products
- EseeCloud
- Organizations
- CISAGuangzhou Juan IoT Technology
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-107617+2 related CVEs | Hard-coded login credential in EseeCloud devices | 9.3 group max | — |
From the original article
5 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App <=4. 9.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.