Critical Hard‑coded Credential Flaws in Guangzhou Juan IoT EseeCloud (CVE‑2026‑107617, CVE‑2026‑97858, CVE‑2026‑105664) Enable Camera Takeover
What It Is – CISA’s advisory (ICS‑A‑26‑288‑02) reports three critical vulnerabilities in the EseeCloud app (≤ 4.9.6) and firmware (≤ 4.9.86.0) used to manage IP cameras. The flaws are hard‑coded credentials, improper object‑attribute modification, and observable response discrepancies.
Exploitability – All three CVEs carry a CVSS v3 score of 9.8, indicating a remote, unauthenticated attacker can gain full control of the camera device. Public exploits have not been released, but the severity and ease of exploitation are high.
Affected Products – Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App and Firmware (versions listed above).
Why It Matters for Trust & Control Assurance
- Demonstrates a gap in identity and access management – hard‑coded secrets bypass normal credential controls.
- Continuous monitoring of credential usage and audit logs becomes essential to prove due‑diligence to auditors.
- Enterprises that must show defensible evidence of privileged‑access hygiene (e.g., for NIST CSF or ISO 27001) will need to remediate and document this control failure.
Recommended Actions
- Inventory every EseeCloud deployment and verify version.
- Apply vendor‑provided patches or upgrade to versions newer than 4.9.6 / 4.9.86.0.
- Immediately rotate any default or hard‑coded credentials; enforce MFA where possible.
- Enable logging of all authentication attempts and integrate logs into a centralized SIEM for continuous monitoring.
Source: CISA Advisory – ICS‑A‑26‑288‑02