{"id":"CVE-2026-97858","kind":"vulnerability","aliases":["CVE-2026-97858"],"related":[],"title":"Device binding flaw lets attacker take over another account's device","description":"An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.","summary":"An attacker can make the server unbind a target device from its current owner and rebind it to the attacker's own account, even when the device belongs to someone else. The attacker then obtains the device's full serial ID.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-binding","iot","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T14:19:36+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:42:29+00:00","updated_at":"2026-10-25T03:42:29+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T03:42:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Device binding flaw lets attacker take over another account's device","impact":"medium","summary":"An attacker can make the server unbind a target device from its current owner and rebind it to the attacker's own account, even when the device belongs to someone else. The attacker then obtains the device's full serial ID.","category":"other","nicknames":[],"who_cares":["iot","device-binding"],"confidence":0.4,"needs_auth":"yes","worst_case":"Attacker takes over a device bound to another account and reads its serial ID","analyst_note":"Identify the vendor and product from NVD CPE data at https://nvd.nist.gov/vuln/detail/CVE-2026-97858 and find the fixed version and affected-setup details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000499,"input_tokens":3283,"output_tokens":342,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-97858':14A,17A 'account':9A,44B,84C,96C 'allow':97C 'anoth':8A 'attack':5A,23B,41B,54B,64C,99C 'belong':49B 'bind':2A,20B 'bound':92C 'caus':66C 'current':34B,76C,91C 'cve':12A,15A 'devic':1A,11A,19B,31B,48B,58B,73C,89C,103C 'device-bind':18B 'differ':95C 'els':52B 'even':45B 'flaw':3A 'full':60B,105C 'id':62B,107C 'iot':21B 'let':4A 'make':25B 'obtain':56B,101C 'owner':35B,77C 'rebind':37B,79C 'regardless':85C 'request':83C 'serial':61B,106C 'server':27B,68C 'someon':51B 'take':6A 'target':30B,72C 'unbind':28B,70C 'whether':87C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T14:19:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97858","severity":null,"published_at":"2026-10-16T14:19:36+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}