You do not have permission to edit this page, for the following reasons:
CVE-2026-107617 (CWE-798, CVSS 9.8 CRITICAL): Hard-coded credentials exist in the EseeCloud App (version β€ 4.9.6) and corresponding firmware. An attacker can exploit these credentials to directly log into EseeCloud devices and gain administrative privileges. This vulnerability affects EseeCloud camera devices deployed across critical infrastructure sectors globally, including energy, communications, transportation, financial services, and government facilities. The vendor, Guangzhou Juan IoT Technology, did not respond to CISA's coordination requests. As of the advisory publication in October 2026, there are no available patches or mitigations, and users are advised to contact the vendor for support. The presence of hard-coded credentials means that even if end-users change their passwords, the static credentials embedded in the firmware may remain valid, allowing attackers to maintain long-term access.
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
