---
id: "CVE-2026-107617"
kind: "vulnerability"
aliases: ["CVE-2026-107617"]
title: "An attacker can use a hard-coded credential to log in to EseeCloud devices"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EseeCloud Firmware", "fixed": [], "affected": "<= 4.9.86.0", "ecosystem": "vendor"}, {"name": "EseeCloud App", "fixed": [], "affected": "<= 4.9.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["eseecloud", "hard-coded-credentials", "infrastructure", "iot-cameras", "no-fix", "self-hosted"]
not_affected_if: ["not-internet-exposed", "not-using-eseecloud", "unknown"]
published_at: "2026-10-16T14:17:16+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T23:33:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107617", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:33:05+00:00"}]
---

# An attacker can use a hard-coded credential to log in to EseeCloud devices

EseeCloud (aka IP Pro / VR Cam) IP camera app and firmware contain a hard-coded credential (CWE-798) allowing network login with no authentication, CVSS 9.8. Vendor Guangzhou Juan IoT did not respond to CISA; no fixed version exists. Reported by Donghyeon Lee (Tokyo Univ. of Science, GMO Flatt Security).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EseeCloud Firmware affected <= 4.9.86.0 fixed ?
- vendor:EseeCloud App affected <= 4.9.6 fixed ?

## How to check

Check whether you use EseeCloud / IP Pro / VR Cam cameras, DVRs or NVRs: EseeCloud app version <= 4.9.6 or device firmware <= 4.9.86.0 (shown in app device info) is affected. Any such device reachable from the internet should be treated as exposed.

## Fix

No vendor fix as of 2026-10-23 (vendor unresponsive; contact https://eseecloud.app/). Mitigate: remove devices from internet exposure (no port forwarding/UPnP), put behind firewall/VPN on an isolated network segment, or replace the devices.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107617
- 2026-10-23T23:33:05+00:00 analyst — CISA ICSA-26-288-02 (primary) + CVE record: app <=4.9.6, firmware <=4.9.86.0 affected; vendor silent, no fix; no exploitation reported; no public PoC found. Did not search social posts (obscure product). Same advisory covers sibling CVE-2026-97858 and CVE-2026-105664.

## Documents

- [advisory] CISA ICSA-26-288-02 EseeCloud https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02
- [describes] CVE Record CVE-2026-107617 https://www.cve.org/CVERecord?id=CVE-2026-107617

## From the sources

An attacker can use a hard-coded credential to log in to EseeCloud devices.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_