As cited
Copy frozen at (site build).
ot ics
Guangzhou Juan IoT Technology EseeCloud
The Cybersecurity and Infrastructure Security Agency (CISA) disclosed three critical and high-severity vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud IP camera management platform, affecting app version 4.9.6 and firmware 4.9.86.0. The flaws include hard-coded credentials enabling unauthorized login (CVE-2026-107617), improper device binding allowing attackers to seize ownership of cameras (CVE-2026-97858), and an enumeration oracle permitting large-scale device discovery (CVE-2026-105664). The vendor did not respond to CISA coordination attempts, and no public exploitation has been reported as of October 15, 2026.
Why it matters: Organizations deploying EseeCloud cameras worldwide in critical infrastructure sectors (energy, communications, transportation, financial services, government) face remote device takeover and reconnaissance risk; immediate inventory of affected installations and isolation behind firewalls or virtual private networks (VPNs) is required pending vendor remediation.
- Source published
- First seen by Cybersecurity Tracker