Guangzhou Juan IoT Technology EseeCloud: 3 CVEs, Critical 9.8
Summary
CISA reports 3 vulnerabilities in Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App, EseeCloud Firmware. Weakness types: Use of Hard-coded Credentials, Improperly Controlled Modification of Dynamically-Determined Object Attributes, Observable Response Discrepancy. Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
At a glance
- Vendor
- Guangzhou Juan IoT Technology Co., Ltd.
- Products
- EseeCloud App, EseeCloud Firmware
- CVEs
- CVE-2026-107617, CVE-2026-97858, CVE-2026-105664
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy, Communications, Transportation Systems, Financial Services, Government Services and Facilities
- Deployed
- Worldwide
- Vendor HQ
- China
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-107617 | Use of Hard-coded Credentials | 9.8 | – | No | An attacker can use a hard-coded credential to log in to EseeCloud devices. |
| CVE-2026-97858 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 5.3 | – | No | An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID. |
| CVE-2026-105664 | Observable Response Discrepancy | 5.3 | – | No | The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization - to distinguish valid ID values from the full 10-digit numeric search space. Combin… |
Affected products (2)
- Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App: <=4.9.6
- Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware: <=4.9.86.0
Vendor fixes and mitigations (from advisory)
- Mitigation: Guangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.