As reported by CISA in advisory ICSA-26-251-01, a hard-coded credential vulnerability in CareCam Pro IP cameras enables full device compromise for any attacker with physical access. The flaw — CVE-2026-85083 — resides in the U-Boot bootloader authentication on the ANJIA AJL33PC0801 model, and critically, no patch exists. CareCam has not responded to CISA's coordination attempts, leaving deployed organizations without a vendor-supported remediation path.
Vulnerability Summary
| Field | Detail |
|---|---|
| CVE | CVE-2026-85083 |
| CWE | CWE-798: Use of Hard-coded Credentials |
| CVSS v3.1 | 6.8 (MEDIUM) — CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS v4.0 | 7.0 (HIGH) |
| Affected Product | CareCam Pro IP Cameras — ANJIA AJL33PC0801 |
| Affected Firmware | linux_linux_202008261138_svn13796 / Bootloader U-Boot 2010.06 (compiled 2020-08-26) |
| Vendor | CareCam (headquartered in China, deployed worldwide) |
| Patch Available | No — vendor unresponsive to CISA coordination |
| Active Exploitation | Not confirmed in the wild at time of disclosure |
| Attack Vector | Physical access required |
Why This Matters More Than the CVSS Suggests
The CVSS v3.1 base score of 6.8 technically rates this as MEDIUM, which may tempt security teams to deprioritize it. That would be a mistake. The physical-access attack vector does limit opportunistic remote exploitation, but the real risk lies in what full bootloader compromise enables: persistent firmware rootkits that survive factory resets, silent reconfiguration of camera feeds, and potential pivoting into the network the camera is attached to. In surveillance contexts — particularly commercial facilities where these cameras may monitor sensitive areas — a compromised device can be turned into a listening post or used to exfiltrate footage to attacker-controlled infrastructure.
More concerning is the vendor abandonment scenario. CareCam has not responded to CISA, meaning there is no reasonable expectation of a firmware update. This transforms a single CVE into a long-term exposure problem. Devices already deployed will remain vulnerable indefinitely unless physically replaced or compensated for through network-layer compensating controls. The underlying U-Boot version (2010.06) is over 15 years old, suggesting the firmware supply chain for this product lacks ongoing security maintenance — a pattern we've seen repeatedly with budget IoT camera manufacturers.
Hard-coded bootloader credentials are among the most fundamental embedded security failures. They cannot be mitigated by configuration changes alone and typically require a firmware rebuild — which the vendor has not provided.
Who Is at Risk
- Commercial facilities deploying CareCam Pro / ANJIA AJL33PC0801 cameras, especially in publicly accessible areas where physical tampering is feasible
- Multi-site retail and hospitality environments that may have procured these cameras at scale through resellers without firmware vetting
- Any organization using these cameras on flat networks without segmentation between surveillance infrastructure and corporate systems
- Integrators and MSPs managing camera deployments for clients who may not be aware of the specific hardware models in use
Immediate Actions
- Inventory and identify: Audit all IP camera deployments for ANJIA AJL33PC0801 models. Check bootloader version strings via serial console or device management interfaces where available.
- Isolate affected cameras: Move any identified devices to a dedicated VLAN with no route to corporate networks or internet egress. Apply egress firewall rules to restrict destinations to known NVR/VMS endpoints only.
- Physically secure devices: Where cameras are deployed in publicly accessible areas, use tamper-evident enclosures, locking mounts, and physical access controls. Document camera locations and inspect regularly for signs of tampering.
- Replace where feasible: Given the absence of a patch, the only complete remediation is device replacement with cameras from vendors with documented security update processes. Prioritize replacement for cameras in high-risk or sensitive locations.
- Monitor network traffic: Deploy IDS rules to detect anomalous connections from camera IPs — unexpected outbound connections, C2-style beaconing, or connections to unknown firmware update servers may indicate compromise.
- Disable unused services: If the device exposes Telnet, SSH, or web interfaces that aren't required for VMS integration, block them at the network layer since the device configuration itself may be mutable post-compromise.
Shield53 Recommendations
Treat this advisory as a procurement and lifecycle issue, not just a patching issue. The inability to remediate at the firmware level means your only controls are physical hardening, network segmentation, and eventual replacement. For organizations with formal IoT/OT asset management programs, this is a strong case for adding "vendor security responsiveness" as a procurement criterion — requiring documented SLAs for vulnerability disclosure and firmware updates before purchase. Cameras from vendors who won't engage with CISA should be treated as unmanageable risk and avoided in new deployments.
Additionally, any organization using Chinese-manufactured surveillance equipment in regulated or sensitive environments should review whether existing export controls, procurement restrictions (such as NDAA Section 889), or internal supply chain policies already prohibit or discourage these devices — and ensure their asset inventories reflect that reality.
