Owners of IP cameras running the EseeCloud app up to version 4.9.6, or firmware up to 4.9.86.0, have no vendor fix to install. CISA, the US cybersecurity agency, published an advisory on three vulnerabilities in the products from Guangzhou Juan IoT Technology, and said the company did not respond to its coordination attempts. The Revision has not contacted the company independently.
The worst of the three, CVE-2026-107617, is a hard-coded credential: a login baked into the product that lets an attacker sign in to EseeCloud devices. It scores 9.8 out of 10 under version 3.1 of the CVSS severity scale and 9.3 under version 4.0. CISA said successful exploitation could let an attacker take control of affected cameras.
The other two score lower, but not harmlessly. CVE-2026-97858 lets an attacker make the server unbind a camera from its current owner and rebind it to the attacker's account, which also reveals the device's full serial ID. It rates 5.3 under 3.1 and 6.9 under 4.0. CVE-2026-105664 is an enumeration flaw: the server returns a different error for a real device ID than for a fake one, and with no meaningful rate limiting, an attacker holding a valid access token can sift through the 10-digit ID space to find registered devices. It rates 5.3 under 3.1 but 8.7 (high) under 4.0.
That spread in scores is worth noticing. The newer scale weighs the enumeration bug far more heavily than the older one.
Read together, the bugs fit a pattern: one finds cameras, one reassigns them, one offers a built-in way in. That is our reading, not a scenario CISA described.
With no patch, CISA's guidance falls back on basics. Keep devices off the internet, place them behind firewalls away from business networks, and use a VPN for remote access, while remembering a VPN is only as secure as the devices behind it. The agency credited Donghyeon Lee of Tokyo University of Science and GMO Flatt Security with reporting the flaws. Users are directed to contact the vendor for support, which is an awkward instruction when the vendor has gone quiet.