{"id":"CVE-2026-107617","kind":"vulnerability","aliases":["CVE-2026-107617"],"related":[],"title":"An attacker can use a hard-coded credential to log in to EseeCloud devices","description":"An attacker can use a hard-coded credential to log in to EseeCloud devices.","summary":"EseeCloud (aka IP Pro / VR Cam) IP camera app and firmware contain a hard-coded credential (CWE-798) allowing network login with no authentication, CVSS 9.8. Vendor Guangzhou Juan IoT did not respond to CISA; no fixed version exists. Reported by Donghyeon Lee (Tokyo Univ. of Science, GMO Flatt Security).","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EseeCloud Firmware","fixed":[],"affected":"<= 4.9.86.0","ecosystem":"vendor"},{"name":"EseeCloud App","fixed":[],"affected":"<= 4.9.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["eseecloud","hard-coded-credentials","infrastructure","iot-cameras","no-fix","self-hosted"],"not_affected_if":["not-internet-exposed","not-using-eseecloud","unknown"],"how_to_check":"Check whether you use EseeCloud / IP Pro / VR Cam cameras, DVRs or NVRs: EseeCloud app version <= 4.9.6 or device firmware <= 4.9.86.0 (shown in app device info) is affected. Any such device reachable from the internet should be treated as exposed.","fix":"No vendor fix as of 2026-10-23 (vendor unresponsive; contact https://eseecloud.app/). Mitigate: remove devices from internet exposure (no port forwarding/UPnP), put behind firewall/VPN on an isolated network segment, or replace the devices.","status":"open","published_at":"2026-10-16T14:17:16+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:05:06+00:00","updated_at":"2026-10-23T23:33:05+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:05:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","impact":"high","summary":"EseeCloud devices ship with a hard-coded credential that is built into the firmware or software. An attacker who knows or extracts that credential can log in to the device without a unique password.","category":"infrastructure","who_cares":["eseecloud","iot-cameras","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker logs in to the device with the built-in credential and controls it.","analyst_note":"Find the NVD entry's CPE and vendor advisory for affected EseeCloud firmware versions, the default credential's scope, and any vendor fix or network exposure guidance.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000422,"input_tokens":2690,"output_tokens":306,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the NVD entry's CPE and vendor advisory for affected EseeCloud firmware versions, the default credential's scope, and any vendor fix or network exposure guidance.","search":"'-107617':18A,21A '-2026':17A,20A '-798':59B '9.8':67B 'aka':42B 'allow':60B 'app':25A,49B 'attack':2A,93C 'authent':65B 'cam':46B 'camera':34B,48B 'cisa':76B 'code':8A,29B,56B,99C 'contain':52B 'credenti':9A,30B,57B,100C 'cve':16A,19A 'cvss':66B 'cwe':58B 'devic':15A,106C 'donghyeon':83B 'eseecloud':14A,22A,24A,26B,41B,105C 'exist':80B 'firmwar':51B 'firmware':23A 'fix':37B,78B 'flatt':90B 'gmo':89B 'guangzhou':69B 'hard':7A,28B,55B,98C 'hard-cod':6A,54B,97C 'hard-coded-credenti':27B 'host':40B 'infrastructur':31B 'iot':33B,71B 'iot-camera':32B 'ip':43B,47B 'juan':70B 'lee':84B 'log':11A,102C 'login':62B 'network':61B 'no-fix':35B 'pro':44B 'report':81B 'respond':74B 'scienc':88B 'secur':91B 'self':39B 'self-host':38B 'tokyo':85B 'univ':86B 'use':4A,95C 'vendor':68B 'version':79B 'vr':45B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T14:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107617","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107617","severity":null,"published_at":"2026-10-16T14:17:16+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107617:466","url":null,"severity":null,"published_at":"2026-10-23T23:33:05+00:00","modified_at":"2026-10-23T23:33:05+00:00","first_seen_at":"2026-10-23T23:33:05+00:00","fetched_at":"2026-10-23T23:33:05+00:00","note":"CISA ICSA-26-288-02 (primary) + CVE record: app <=4.9.6, firmware <=4.9.86.0 affected; vendor silent, no fix; no exploitation reported; no public PoC found. Did not search social posts (obscure product). Same advisory covers sibling CVE-2026-97858 and CVE-2026-105664."}],"documents":[{"id":2035,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02","title":"CISA ICSA-26-288-02 EseeCloud","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2037,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107617","title":"CVE Record CVE-2026-107617","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}