Government Advisory

Critical Flaws in EseeCloud IP Cameras Could Let Attackers Take Control

CISA · 15 Oct 2026

Key Takeaway If your business uses EseeCloud cameras, check your app and firmware versions, keep the cameras off the public internet and separate from your main network, and consider replacing them if the vendor does not release a fix.

The US Cybersecurity and Infrastructure Security Agency (CISA) has published an advisory about EseeCloud, a product from Guangzhou Juan IoT Technology Co., Ltd. in China. It says successful exploitation of three vulnerabilities could allow an attacker to gain control over affected IP cameras. The flaws carry a CVSS score of 9.8 out of 10, which is critical.

The affected versions are the EseeCloud app up to version 4.9.6 and the EseeCloud firmware up to version 4.9.86.0. The three issues are the use of hard-coded credentials, improper control over changes to object attributes, and an observable response discrepancy. In the hard-coded credential flaw (CVE-2026-107617), an attacker can use a built-in login to access EseeCloud devices. The other two are tracked as CVE-2026-97858 and CVE-2026-105664. The advisory notes the products are deployed worldwide.

The mitigation section of the advisory indicates that the vendor did not respond to CISA. Businesses should therefore not assume a fix is coming and should plan around that.

IP cameras CISA advisory hard-coded credentials IoT security

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.