Hard-Coded Credentials in EseeCloud IP Cameras Give Attackers Full Remote Control—No Patch Available
Executive Summary
In October 2026, CISA published ICS Advisory ICSA-26-288-02 disclosing three critical-to-medium severity vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud IP camera platform, affecting App versions ≤4.9.6 and Firmware versions ≤4.9.86.0 deployed worldwide across energy, communications, transportation, financial services, and government sectors. The most severe flaw, CVE-2026-107617 (CVSS 9.8), embeds hard-coded credentials that allow any remote, unauthenticated attacker to log in to EseeCloud devices at will. A second vulnerability, CVE-2026-97858, permits unauthorized device rebinding—stripping ownership from legitimate users and reassigning control to an attacker. A third flaw, CVE-2026-105664, exposes an enumeration oracle that lets token-holders discover every registered device serial ID at scale due to absent rate limiting. The vendor did not respond to CISA's coordination attempts, leaving no vendor patch available.
These findings arrive amid a documented surge in nation-state and criminal exploitation of consumer and industrial IoT devices as persistent footholds into critical infrastructure networks. Hard-coded credential abuse in embedded devices has become a primary initial-access vector, and the absence of encrypted traffic controls means camera feeds and command channels remain fully interceptable once an attacker gains network adjacency.
Why This Matters Now
IoT devices like IP cameras are being actively weaponized as initial-access footholds into OT and critical infrastructure environments. With the EseeCloud vendor unresponsive and no patch available, millions of deployed cameras remain permanently exposed. Combined with zero rate limiting and a device-enumeration oracle, adversaries can silently map and seize entire camera fleets—making network segmentation and encrypted traffic enforcement immediately urgent for any organization running these devices.
Attack Path Analysis
An attacker targeting EseeCloud IP cameras begins by exploiting hard-coded credentials (CVE-2026-107617) to gain unauthenticated remote access over the internet, immediately obtaining full device control without any privilege escalation barrier. The attacker then leverages an enumeration oracle vulnerability (CVE-2026-105664) combined with an insecure device rebinding flaw (CVE-2026-97858) to discover and hijack additional registered devices at scale, pivoting across the cloud-managed IoT fleet, establishing persistent command and control through the compromised cloud backend, and ultimately exfiltrating live camera feeds and device metadata while disrupting legitimate owner access across critical infrastructure sectors worldwide.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attacker exploits CVE-2026-107617, using hard-coded credentials embedded in EseeCloud App and Firmware (<=4.9.6 / <=4.9.86.0) to authenticate to internet-exposed IP camera devices and the cloud management backend without any valid user account. With CVSS 9.8, the exploit requires no privileges, no user interaction, and is remotely executable at scale against all unpatched devices worldwide.
Related CVEs
CVE-2026-107617
CVSS 9.8A hard-coded credential vulnerability in Guangzhou Juan IoT Technology EseeCloud App and Firmware allows an unauthenticated remote attacker to log in to affected devices, potentially gaining full administrative control.
Affected Products:
Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App – <=4.9.6
Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware – <=4.9.86.0
Exploit Status:
no public exploitCVE-2026-97858
CVSS 5.3An improperly controlled modification of dynamically-determined object attributes in EseeCloud allows an unauthenticated remote attacker to unbind a target device from its current owner account and rebind it to an attacker-controlled account by obtaining the device serial ID.
Affected Products:
Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App – <=4.9.6
Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware – <=4.9.86.0
Exploit Status:
no public exploitCVE-2026-105664
CVSS 5.3An observable response discrepancy vulnerability in the EseeCloud API endpoint enables an attacker holding a valid access token to enumerate all registered device IDs across the full 10-digit numeric search space by distinguishing valid from invalid IDs through differential error responses, with no meaningful rate limiting in place.
Affected Products:
Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App – <=4.9.6
Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware – <=4.9.86.0
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Valid Accounts: Default Accounts
Brute Force: Password Guessing
Unsecured Credentials: Credentials In Files
Active Scanning: Scanning IP Blocks
Gather Victim Host Information: Hardware
Data Manipulation: Stored Data Manipulation
Modify Authentication Process
Network Sniffing
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Authenticator Management: Password-Based Authentication
Control ID: IA-5(1)
CISA Zero Trust Maturity Model 2.0 – Device Identity and Authorization Enforcement
Control ID: Device Pillar – Device Visibility and Analytics
NIS2 Directive – Security in Network and Information Systems
Control ID: Article 21 – Cybersecurity Risk Management Measures
PCI DSS 4.0 – Passwords and Passphrases for User Accounts
Control ID: Requirement 8.3.6
DORA (EU 2022/2554) – ICT Asset and Access Management Controls
Control ID: Article 9 – ICT Security Policies, Procedures, Protocols and Tools
NYDFS 23 NYCRR 500 – Minimum Privilege and Credential Governance
Control ID: Section 500.7 – Access Privileges and Management
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
EseeCloud IP camera CVEs (CVSS 9.8) expose government facilities to full device takeover via hard-coded credentials, threatening physical security infrastructure across CISA-identified critical government services and facilities worldwide.
Oil/Energy/Solar/Greentech
IoT device compromise via CVE-2026-107617 hard-coded credentials endangers energy sector OT/ICS environments; CISA advisory explicitly lists Energy as a critical infrastructure sector facing EseeCloud camera exploitation risk.
Transportation
EseeCloud firmware vulnerabilities enabling device rebinding and enumeration oracles directly threaten transportation surveillance systems, a CISA-designated critical sector with broad worldwide EseeCloud deployment exposure.
Financial Services
Hard-coded credential exploitation and device enumeration against EseeCloud cameras risk physical security bypass at financial institutions, with PCI 4.0 and NIST.800-53.SC-7 compliance gaps amplifying lateral movement and exfiltration threat surfaces.
Sources
- Guangzhou Juan IoT Technology EseeCloudhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02Verified
- CISA ICS Advisories Landing Pagehttps://www.cisa.gov/news-events/ics-advisoriesVerified
- CWE-798: Use of Hard-coded Credentialshttps://cwe.mitre.org/data/definitions/798.htmlVerified
- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributeshttps://cwe.mitre.org/data/definitions/915.htmlVerified
- CWE-204: Observable Response Discrepancyhttps://cwe.mitre.org/data/definitions/204.htmlVerified
- CISA Recommended Practices for ICS Cybersecurity: Defense-in-Depth Strategieshttps://www.cisa.gov/icsVerified
- NVD National Vulnerability Databasehttps://nvd.nist.gov/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant here because the attacker's ability to reach internet-exposed camera devices, pivot across the cloud-managed IoT fleet, and exfiltrate data at scale depends on unrestricted network reachability and the absence of segmentation controls. By enforcing identity-aware segmentation and controlled egress at the cloud network layer, CNSF would likely constrain the attacker's lateral reach and reduce the blast radius across the broader EseeCloud-connected device fleet.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF enforcement may limit direct internet reachability to camera management endpoints, reducing the attacker's ability to freely authenticate against exposed devices at scale across the fleet.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the administrative scope available to an authenticated session by limiting which cloud management functions and backend resources a device identity is permitted to reach.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to pivot freely across the cloud backend by restricting which workloads and API endpoints can communicate with one another without explicit policy authorization.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control could help surface anomalous communication patterns between hijacked devices and the management plane, potentially reducing the attacker's ability to sustain undetected command and control across the fleet.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policy enforcement would likely reduce the attacker's ability to stream large volumes of video and device metadata outbound by constraining which destinations, protocols, and data volumes are permitted to leave the cloud environment.
Where prior CNSF controls had been applied across earlier stages, the residual impact on critical infrastructure facilities would likely be constrained to a smaller subset of devices rather than the full fleet, reducing the attacker's persistent surveillance footprint.
Impact at a Glance
Affected Business Functions
- IP Camera Surveillance and Physical Security Monitoring
- Remote Device Management and IoT Fleet Administration
- Critical Infrastructure Monitoring (Energy, Transportation, Communications)
- Government and Commercial Facilities Security Operations
Estimated downtime: N/A
Estimated loss: N/A
Exploitation of these vulnerabilities could expose live and recorded video feeds from IP cameras deployed across critical infrastructure sectors including energy, communications, transportation, financial services, and government facilities worldwide. Hard-coded credential abuse (CVE-2026-107617) enables full device takeover with access to camera streams and configuration data. Device ownership hijacking (CVE-2026-97858) allows attackers to reassign cameras to attacker-controlled accounts, permanently severing legitimate owner access and enabling covert surveillance. The enumeration oracle (CVE-2026-105664) allows large-scale discovery of all registered EseeCloud device serial IDs, enabling targeted follow-on attacks. The vendor did not respond to CISA coordination, meaning no patch is available, leaving all users of EseeCloud App versions 4.9.6 and below and Firmware versions 4.9.86.0 and below exposed indefinitely. Data at risk includes physical premises video surveillance data, device configuration credentials, device serial identifiers, and account ownership metadata for a globally deployed IoT camera platform.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Cloud Native Security Fabric (CNSF) inline enforcement and Multicloud Visibility & Control to baseline normal EseeCloud API interaction patterns and generate alerts on anomalous device rebinding requests, bulk serial ID enumeration attempts, and repeated malformed or automated API calls that match CVE-2026-105664 exploitation behavior.
- • Enforce Egress Security & Policy Enforcement with FQDN-based filtering and outbound traffic controls to prevent unauthorized video stream exfiltration from compromised camera devices to attacker-controlled destinations, and to block data exfiltration traversing the cloud backend to unknown or unapproved external endpoints.
- • Apply Zero Trust Segmentation with identity-based policy and microsegmentation to isolate IoT camera networks from business and critical infrastructure networks, ensuring that even if a device is compromised via hard-coded credentials, lateral movement to adjacent segments and cloud management APIs is blocked by least-privilege trust boundaries.
- • Implement East-West Traffic Security controls to monitor and restrict workload-to-workload and service-to-service communication between the EseeCloud cloud management backend and connected devices, preventing the platform API from being abused as a lateral movement vector to rebind and hijack devices across the entire managed fleet.
- • Enable Inline IPS (Suricata) with signature-based detection tuned to known IoT exploit patterns and Encrypted Traffic (HPE) to ensure that camera-to-cloud and cloud-to-attacker traffic is both inspectable and protected, preventing packet sniffing of unencrypted video streams while detecting exploit payloads targeting CVE-2026-107617 and CVE-2026-97858 before they complete.
