(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| EseeCloud App
|
|
Security Grade
Calculator v
|
EseeCloud App / EseeCloud-enabled IoT devices
Release Date: 2015-09-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
|
| Prior attacks
|
None
|
🔗 Proof
|
|
| Updatability
|
None
|
🔗 Proof
|
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
No
|
🔗 Proof
|
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
|
| Storage
|
No encryption
|
🔗 Proof
|
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Absent
|
🔗 Proof
|
|
| Authentication
|
Absent
|
🔗 Proof
|
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
|
| Event logging
|
Absent
|
🔗 Proof
|
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Android / iOS / firmware-dependent (Companion App: EseeCloud)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera: app manages cameras
|
| Sound & Connectivity
|
Sound: • Connectivity: Internet
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
CVE-2026-107617 (CWE-798, CVSS 9.8 CRITICAL): Hard-coded credentials exist in the EseeCloud App (version ≤ 4.9.6) and corresponding firmware. An attacker can exploit these credentials to directly log into EseeCloud devices and gain administrative privileges. This vulnerability affects EseeCloud camera devices deployed across critical infrastructure sectors globally, including energy, communications, transportation, financial services, and government facilities. The vendor, Guangzhou Juan IoT Technology, did not respond to CISA's coordination requests. As of the advisory publication in October 2026, there are no available patches or mitigations, and users are advised to contact the vendor for support. The presence of hard-coded credentials means that even if end-users change their passwords, the static credentials embedded in the firmware may remain valid, allowing attackers to maintain long-term access.
