As reported by CISA in advisory ICSA-26-288-02, three critical vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud IP camera platform expose organizations to complete remote device takeover. The advisory is particularly alarming because the vendor has not responded to CISA's coordination attempts, leaving affected users without an official patch.
Vulnerability Summary
| CVE | CVSS v3.1 | Description | Patch Available |
|---|---|---|---|
| CVE-2026-107617 | 9.8 Critical | Hard-coded credentials allow attacker login to EseeCloud devices | No — vendor unresponsive |
| CVE-2026-97858 | 9.8 Critical | Device rebinding flaw — attacker unbinds device from legitimate owner and rebinds to attacker account, exposing full serial ID | No — vendor unresponsive |
| CVE-2026-105664 | 9.8 Critical | Observable response discrepancy enables information disclosure | No — vendor unresponsive |
Affected products: EseeCloud App ≤4.9.6 and EseeCloud Firmware ≤4.9.86.0. CVSS v4.0 scoring rates these at 9.3 Critical.
Why This Matters
These are not minor bugs — they represent a systemic failure of the device's authentication and ownership model. CVE-2026-107617 means anyone who knows the hard-coded credential (which is now publicly documented in the advisory) can log in to any affected EseeCloud device. CVE-2026-97858 compounds this by allowing an attacker to steal the device itself from its legitimate owner's account, rebinding it to an attacker-controlled account. Combined with the information disclosure from CVE-2026-105664, these flaws create a pathway for silent surveillance, lateral reconnaissance, and persistent access.
The fact that CISA publicly noted the vendor's non-response is itself a signal — it places the burden of risk mitigation squarely on the operator.
CISA explicitly lists Energy, Communications, Transportation, Financial Services, and Government Facilities as exposed critical infrastructure sectors. These cameras are deployed worldwide, meaning any organization using EseeCloud-branded or OEM-rebranded devices in sensitive areas — server rooms, loading docks, utility substations, financial trading floors — is at risk. IP cameras in these environments often capture footage that could reveal proprietary operations, personnel movements, or security configurations.
Supply Chain Complications
Guangzhou Juan IoT Technology devices are frequently white-labeled or rebranded under different names, which means your asset inventory may not explicitly list "EseeCloud." Defenders should check for the EseeCloud mobile app on corporate devices, query network logs for traffic to eseecloud.app domains, and physically inspect camera units for manufacturer markings.
Immediate Actions
*.eseecloud.app or matching known EseeCloud MAC OUI prefixes.Shield53 Recommendations
Organizations should treat unpatchable IoT cameras as inherently untrusted endpoints:
- Accelerate replacement planning: Given the vendor's non-response, plan to retire and replace EseeCloud devices in critical or sensitive areas. Prioritize cameras in Energy, Government, and Financial sector deployments.
- Implement network-level compensating controls: Use firewall rules, IDS/IPS signatures, and DNS filtering to detect and block anomalous EseeCloud cloud communications.
- Establish IoT procurement standards: Require vendors to provide firmware update commitments, vulnerability disclosure policies, and SBOMs before future camera purchases. The absence of these should disqualify vendors for critical infrastructure use.
- Monitor for active exploitation: While CISA has not confirmed in-the-wild exploitation at time of advisory publication, the public disclosure of hard-coded credentials makes active exploitation highly likely. Deploy network detection rules for EseeCloud authentication traffic and device rebinding API calls.
This advisory underscores a recurring pattern in IoT security: low-cost devices with opaque supply chains and minimal vendor accountability create persistent risk in critical environments. When a vendor fails to respond to a national CERT, the only responsible action is to treat the device as compromised and plan its removal.
