Hard-Coded Credentials in CareCam Pro IP Cameras Expose Devices to Physical Compromise
A critical vulnerability in CareCam Pro IP cameras allows attackers with physical access to gain privileged control due to hard-coded bootloader credentials.
CISA has issued an advisory detailing a significant security flaw affecting CareCam Pro IP cameras, specifically the ANJIA AJL33PC0801 model with firmware version linux_linux_202008261138_svn13796 / Bootloader U-Boot 2010.06. The vulnerability, identified as CVE-2026-85083, stems from the use of hard-coded credentials within the device's bootloader authentication mechanism.
This hard-coding means that a static, predictable password or key is embedded directly into the firmware, allowing anyone with physical access to the camera to bypass standard authentication procedures. Successful exploitation grants an attacker privileged access to the bootloader, which is a critical stage in the device's startup process. From this vantage point, an attacker can manipulate the device at a fundamental level.
The potential impact of exploiting this vulnerability is severe. An attacker with physical access could modify the device's firmware, alter its system configuration, or even install malicious code. This could lead to a complete compromise of the device, turning it into a pivot point for further network intrusion, a tool for surveillance, or simply rendering it inoperable. The CVSS v3.1 score of 6.8 (MEDIUM) and CVSS v4.0 score of 7 (HIGH) reflect the significant risk posed by this flaw, particularly given the potential for complete device compromise.
While the vulnerability is not remotely exploitable, the requirement for physical access does not diminish its severity, especially for devices deployed in accessible locations or during installation. The advisory notes that the affected product is deployed worldwide, increasing the potential attack surface. Critical infrastructure sectors, including commercial facilities, could be at risk if these cameras are integrated into their networks.
Compounding the issue, CareCam has not responded to CISA's attempts to coordinate a response or develop a patch. This lack of vendor engagement leaves users without official remediation guidance. CISA is urging users to reach out to CareCam directly for any available information or support regarding this vulnerability.
In the absence of vendor-provided patches, CISA recommends standard defensive measures to mitigate the risk. These include minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, and placing them behind firewalls. For remote access, the use of secure methods like Virtual Private Networks (VPNs) is advised, with the caveat that VPNs themselves must be kept updated and secure.
Organizations are encouraged to perform thorough impact and risk assessments before implementing any defensive measures. CISA also points to its extensive resources on industrial control systems (ICS) cybersecurity, including best practices for defense-in-depth strategies and targeted cyber intrusion detection and mitigation. Proactive cybersecurity strategies are crucial for protecting ICS assets.
Omkar Mali is credited with reporting this vulnerability to CISA. While no known public exploitation targeting this specific vulnerability has been reported to CISA at this time, the inherent risk associated with hard-coded credentials in critical device components remains a significant concern for security professionals.