Guangzhou Juan IoT Technology EseeCloud

Reporting by CISA AlertsRead the original at cisa.gov

Executive Summary

Successful exploitation of vulnerabilities in Guangzhou Juan IoT Technology EseeCloud could grant an attacker control over affected IP cameras. The vulnerabilities affect the EseeCloud App versions up to 4.9.6 and Firmware versions up to 4.9.86.0, related to three distinct CVEs: CVE-2026-107617, CVE-2026-97858, and CVE-2026-105664. One vulnerability allows an attacker to log in using hard-coded credentials, another enables an attacker to take ownership of a device by reassigning its serial ID, and the final one creates an enumeration oracle by allowing an attacker to distinguish valid IDs from invalid ones through response discrepancies. These flaws impact both the application and firmware components. The vendor has not responded to CISA coordination attempts. Users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support.

Facts Only

* The EseeCloud App version <=4.9.6 is affected by CVE-2026-107617, CVE-2026-97858, and CVE-2026-105664.
* The EseeCloud Firmware version <=4.9.86.0 is affected by CVE-2026-107617, CVE-2026-97858, and CVE-2026-105664.
* CVE-2026-107617 allows an attacker to log in using a hard-coded credential.
* CVE-2026-97858 allows an attacker to cause the server to rebind a device's serial ID to a requesting account.
* CVE-2026-105664 allows an observable response discrepancy when processing ID values, enabling enumeration of registered devices.
* The vulnerabilities affect Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App <=4.9.6 and Firmware <=4.9.86.0.
* Related CWEs include CWE-798 (Use of Hard-coded Credentials), CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), and CWE-204 (Observable Response Discrepancy).

Full Take

The structure of these vulnerabilities, spanning credential compromise, identity manipulation, and information leakage via response discrepancies, suggests a systemic failure in the core security controls for the EseeCloud platform. The fact that similar flaws affect both the application layer and the underlying firmware points toward insufficient separation between user-facing logic and device control mechanisms. The presence of an enumeration oracle (CVE-2026-105664) combined with credential issues suggests a critical risk: not only can an attacker gain access but also map the entire operational environment without needing further interactive authentication, fundamentally eroding trust in the system's state reporting. The lack of response from the vendor to coordination efforts indicates an organizational disconnect regarding risk management and remediation, which compounds the risk for the deployment sectors mentioned. This pattern implies that security hardening must be viewed not as a patch application but as a comprehensive architectural review focusing on input validation, authentication boundaries, and output integrity across the entire software stack.
Bridge Questions: If controls were applied at the protocol level rather than just the application level, would the enumeration oracle still be exploitable? What internal processes exist to ensure that firmware updates and application logic are subject to independent security review before release? How does the failure to respond to coordination efforts influence the perceived severity of these known flaws for end-users?

From the original · CISA Alerts

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras.

Read the full story at cisa.gov

Sentinel — Human

Confidence

This text reads like a structured, factual translation of a security advisory, focusing on specific CVEs and mitigation instructions rather than narrative synthesis.

Signals Detected

Sentence length variance is moderate; structure is heavily dictated by technical listing rather than narrative flow.

Highly factual and structured, lacking the typical emotional cadence or exploratory framing of purely synthetic text.

The structure follows a strict bulletin/report format (CVE listings, CVSS scores, remediation steps), which is characteristic of official advisories.

Claims are tied directly to specific CVEs and vendor notifications, suggesting reliance on verifiable external data rather than pure LLM invention.

Human Indicators

The inclusion of detailed, multi-layered links to CISA documentation and specific technical artifacts suggests sourcing from an official security notification process.

The tone shifts appropriately between technical severity (CVSS scores) and practical advice (mitigation steps), demonstrating context typical of security advisories.