How do I check whether I am affected by CVE-2026-107617?

Check whether you use EseeCloud / IP Pro / VR Cam cameras, DVRs or NVRs: EseeCloud app version <= 4.9.6 or device firmware <= 4.9.86.0 (shown in app device info) is affected. Any such device reachable from the internet should be treated as exposed.

What is the fix for CVE-2026-107617?

No vendor fix as of 2026-10-23 (vendor unresponsive; contact https://eseecloud.app/). Mitigate: remove devices from internet exposure (no port forwarding/UPnP), put behind firewall/VPN on an isolated network segment, or replace the devices.

Who is not affected by CVE-2026-107617?

Not affected if: not-internet-exposed, not-using-eseecloud, unknown.

Live › vulnerability › CVE-2026-107617

Go to dashboard

critical9.8Infrastructure

An attacker can use a hard-coded credential to log in to EseeCloud devices

Q: What is the fix for CVE-2026-107617?

No vendor fix as of 2026-10-23 (vendor unresponsive; contact https://eseecloud.app/). Mitigate: remove devices from internet exposure (no port forwarding/UPnP), put behind firewall/VPN on an isolated network segment, or replace the devices.

Q: Who is not affected by CVE-2026-107617?

Not affected if: not-internet-exposed, not-using-eseecloud, unknown.

EseeCloud (aka IP Pro / VR Cam) IP camera app and firmware contain a hard-coded credential (CWE-798) allowing network login with no authentication, CVSS 9.8. Vendor Guangzhou Juan IoT did not respond to CISA; no fixed version exists. Reported by Donghyeon Lee (Tokyo Univ. of Science, GMO Flatt Security).

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.8

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker logs in to the device with the built-in credential and controls it.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

2 products

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-107617

Go to dashboard

critical9.8Infrastructure

An attacker can use a hard-coded credential to log in to EseeCloud devices

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.8

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker logs in to the device with the built-in credential and controls it.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

2 products

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
EseeCloud Firmware	vendor	<= 4.9.86.0	–
EseeCloud App	vendor	<= 4.9.6	–

An attacker can use a hard-coded credential to log in to EseeCloud devices

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

An attacker can use a hard-coded credential to log in to EseeCloud devices

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources