Critical Vulnerabilities in Guangzhou Juan EseeCloud App and Firmware Threaten IP Camera Security
CISA has issued a critical advisory for multiple vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud App and Firmware, potentially allowing attackers full control over affected IP cameras.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a critical advisory detailing three severe vulnerabilities affecting Guangzhou Juan IoT Technology's EseeCloud App and Firmware. These flaws, present in EseeCloud App versions up to 4.9.6 and Firmware versions up to 4.9.86.0, could allow an unauthenticated attacker to gain complete control over vulnerable IP cameras.
The vulnerabilities include CVE-2026-107617, which involves the use of hard-coded credentials. This allows attackers to log into EseeCloud devices using pre-defined, easily obtainable credentials, bypassing normal authentication mechanisms. This grants them initial access to the device's system.
Another critical vulnerability, CVE-2026-97858, enables unauthorized device rebinding. An attacker can exploit this flaw to unbind a target device from its legitimate owner and rebind it to their own account. This allows the attacker to gain control and ownership of the device, even if it is already registered to another user.
Furthermore, CVE-2026-105664 involves an observable response discrepancy. This vulnerability allows an attacker, even with limited access, to distinguish between valid and invalid device IDs. By exploiting this discrepancy, attackers can effectively enumerate and discover registered devices at scale, especially when combined with the lack of robust rate limiting on the affected endpoints.
Collectively, these vulnerabilities carry a CVSS v3.1 base score of 9.8, classifying them as CRITICAL. Successful exploitation could lead to unauthorized access, complete device control, and potential misuse of the IP cameras for surveillance or other malicious activities. The advisory highlights that these vulnerabilities affect critical infrastructure sectors including Energy, Communications, Transportation Systems, Financial Services, and Government Services.
Guangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination efforts to address these security issues. Consequently, there are no official patches or vendor-supplied mitigations available at this time. CISA strongly advises users of affected EseeCloud products to contact Guangzhou Juan IoT Technology directly for support and guidance, though the company's responsiveness remains a concern.
Given the lack of vendor response and the critical nature of these vulnerabilities, users are urged to implement all available security best practices. This includes network segmentation to isolate affected devices, disabling remote access if not strictly necessary, and monitoring network traffic for suspicious activity. Organizations relying on EseeCloud devices should consider alternative solutions if immediate remediation is not possible.
The widespread deployment of IP cameras in critical infrastructure and sensitive environments makes these vulnerabilities a significant concern. The potential for attackers to gain full control over these devices underscores the importance of timely vulnerability disclosure and vendor accountability in securing the Internet of Things (IoT) ecosystem.