Cisagov CareCam CM2507: Four Vulnerabilities Disclosed Together, Ranging from Low to Critical
Key findings • Four vulnerabilities in Cisagov CareCam CM2507 disclosed on September 18, 2026. • Critical flaw allows recovery of cleartext Wi-Fi credentials via filesystem access. • High…
Key findings
- Four vulnerabilities in Cisagov CareCam CM2507 disclosed on September 18, 2026.
- Critical flaw allows recovery of cleartext Wi-Fi credentials via filesystem access.
- High-severity bug enables privileged access with an empty password over the network.
- Medium-severity vulnerability permits arbitrary code execution via malicious scripts on removable media.
- Low-severity issue exposes an unauthenticated interactive bootloader via physical debug interface.
On September 18, 2026, a batch of four vulnerabilities affecting the Cisagov CareCam CM2507 IP camera was disclosed. These vulnerabilities, detailed in CISA ICS Advisory ICSA-26-258-08, collectively pose significant risks, including unauthorized access to live video, sensitive device information, execution of arbitrary code, and recovery of stored credentials. The affected firmware version is HMT.CM2507 v251211.1507.
The vulnerabilities can be grouped by their impact and attack vector.
Physical Access and Debugging Interface Exploitation
CVE-2026-85478, a low-severity flaw, involves an interactive bootloader exposed through a physical debug interface without authentication. An attacker with physical access can interrupt the boot process to inspect or modify boot configurations.
Credential Exposure and Unauthorized Access
CVE-2026-81321, a critical vulnerability, allows an attacker with filesystem access to recover stored wireless network credentials (network identifier and pre-shared key) because they are stored in cleartext. This could be achieved through physical access, a debugging interface, or another vulnerability.
CVE-2026-84398, a high-severity vulnerability, permits an attacker with network access to log into the ONVIF management service with an empty password for a privileged account. This grants access to privileged management functions and sensitive device and user configuration information.
Arbitrary Code Execution via Removable Media
CVE-2026-81305, a medium-severity vulnerability, enables an attacker with physical access to execute arbitrary code by supplying a malicious script to the device. The camera automatically executes scripts from removable media without verifying their authenticity or integrity.
Successful exploitation of these vulnerabilities could allow an attacker to access live video and sensitive device information, enable unauthorized services, execute arbitrary code, modify device operation, and recover stored credentials. The specific firmware version affected is HMT.CM2507 v251211.1507.
Users of the Cisagov CareCam CM2507 are advised to consult CISA ICS Advisory ICSA-26-258-08 for detailed mitigation strategies and to ensure their devices are running the latest secure firmware. The coordinated disclosure highlights the importance of securing embedded devices, particularly those in critical infrastructure, against both physical and network-based threats.