CVE-2026-107617 Details
Description
An attacker can use a hard-coded credential to log in to EseeCloud devices.
A vulnerability exists in Guangzhou Juan IoT Technology EseeCloud devices, including the EseeCloud App and EseeCloud Firmware, both through version 4.9.6 and 4.9.86.0 respectively. The issue arises from hard-coded credentials that allow unauthorized access to these devices. Successful exploitation could enable an attacker to gain control over affected IP cameras.
Users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support. Additional guidance may be available on the EseeCloud website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://eseecloud.app/ | [email protected] | ProductVendor |
| https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json | [email protected] | BundleTechnical Description |
| https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02 | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Guangzhou Juan IoT Technology EseeCloud | <= 4.9.6 (semver) <= 4.9.86.0 |
CPE
Remediation
| |
| Guangzhou Juan IoT Technology N8225 | All versions |
CPE
Remediation
| |
| Guangzhou Juan IoT Technology N8216 | All versions |
CPE
Remediation
| |
| Guangzhou Juan IoT Technology DVR JA-R5124-H | All versions |
CPE
Remediation
| |
| Guangzhou Juan IoT Technology DVR JA-R5116-2H | All versions |
CPE
Remediation
| |
| Guangzhou Juan IoT Technology DVR JA-R5108-2H | All versions |
CPE
Remediation
| |
| Guangzhou Juan IoT Technology N8236 | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |