Answer Brief
CISA issued advisory ICSA-26-288-02 regarding three vulnerabilities in Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App and Firmware, which could allow an attacker to gain control over affected IP cameras. The vendor did not respond to CISA's coordination attempts, and the flaws include a critical hard-coded credential vulnerability that allows an attacker to log in to EseeCloud devices across worldwide deployments.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
CISA publishes ICS Advisory ICSA-26-288-02 detailing three vulnerabilities in Guangzhou Juan IoT Technology EseeCloud App and Firmware.
Executive Summary: CISA issued advisory ICSA-26-288-02 regarding three vulnerabilities in Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App and Firmware, which could allow an attacker to gain control over affected IP cameras. The vendor did not respond to CISA's coordination attempts, and the flaws include a critical hard-coded credential vulnerability that allows an attacker to log in to EseeCloud devices across worldwide deployments.
Why It Matters
On October 15, 2026, the Cybersecurity and Infrastructure Security Agency released ICS Advisory ICSA-26-288-02 detailing three security vulnerabilities affecting Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App and Firmware. The advisory warns that successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras.
The alert states that the affected products include Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App versions <=4.9.6 and EseeCloud Firmware versions <=4.9.86.0. Both components are listed as known affected across all three disclosed Common Vulnerabilities and Exposures records.
Technical Signal
The first vulnerability, tracked as CVE-2026-107617, involves CWE-798 (Use of Hard-coded Credentials). CISA states that an attacker can use a hard-coded credential to log in to EseeCloud devices. CVE-2026-107617 has a CVSS v3.1 base score of 9.8 (CRITICAL) and CVE-2026-107617 has a CVSS v4.0 base score of 9.3 (CRITICAL).
The second vulnerability, identified as CVE-2026-97858, involves CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). Under this flaw, an attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID. CVE-2026-97858 has a CVSS v3.1 base score of 5.3 (MEDIUM) and CVE-2026-97858 has a CVSS v4.0 base score of 6.9 (MEDIUM).
Operational Impact
The third vulnerability, designated CVE-2026-105664, involves CWE-204 (Observable Response Discrepancy). According to the advisory, the endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token—but without further authentication or authorization—to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale. CVE-2026-105664 has a CVSS v3.1 base score of 5.3 (MEDIUM) and CVE-2026-105664 has a CVSS v4.0 base score of 8.7 (HIGH).
Regarding remediation, Guangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. In the absence of confirmed vendor updates or patches, CISA advises EseeCloud users to contact Guangzhou Juan IoT Technology Co., Ltd. directly for support through its web portal.
What To Watch
The advisory notes that Guangzhou Juan IoT Technology Co., Ltd. maintains its company headquarters location in China, with affected equipment deployed worldwide. The technology is utilized across multiple critical infrastructure sectors, specifically Energy, Communications, Transportation Systems, Financial Services, and Government Services and Facilities.
The vulnerabilities were reported to CISA by Donghyeon Lee of Tokyo University of Science and GMO Flatt Security. CISA confirmed that no known public exploitation specifically targeting these vulnerabilities has been reported at the time of publication.
To minimize risk of exploitation, CISA recommends several defensive measures for operators running affected control systems. These include minimizing network exposure for all control system devices and systems ensuring they are not accessible from the internet, locating control system networks and remote devices behind firewalls and isolating them from business networks, and using more secure methods such as virtual private networks when remote access is required.
Event Type: security
Importance: high
Affected Companies
- Guangzhou Juan IoT Technology Co., Ltd.
Affected Sectors
- Energy
- Communications
- Transportation Systems
- Financial Services
- Government Services and Facilities
Key Numbers
- Vulnerabilities: 3
- numeric search space: 10-digit
- Revision: 1
Timeline
- CISA publishes ICS Advisory ICSA-26-288-02 detailing three vulnerabilities in Guangzhou Juan IoT Technology EseeCloud App and Firmware.
Frequently Asked Questions
Which Guangzhou Juan IoT Technology products and versions are affected?
CISA reports that EseeCloud App versions <=4.9.6 and EseeCloud Firmware versions <=4.9.86.0 from Guangzhou Juan IoT Technology Co., Ltd. are affected by all three vulnerabilities: CVE-2026-107617, CVE-2026-97858, and CVE-2026-105664.
What are the specific vulnerabilities identified in EseeCloud?
The advisory identifies CVE-2026-107617 for hard-coded credentials, CVE-2026-97858 for improperly controlled modification of dynamically-determined object attributes allowing account rebinding, and CVE-2026-105664 for an observable response discrepancy acting as an enumeration oracle to discover registered devices at scale.
Did Guangzhou Juan IoT Technology provide patches or coordinate with CISA?
Guangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. As a result, no vendor patch was announced in the advisory, and CISA advises EseeCloud users to contact Guangzhou Juan IoT Technology Co., Ltd. for support via its website.
Has active public exploitation been observed for these vulnerabilities?
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. The vulnerabilities were reported to CISA by Donghyeon Lee of Tokyo University of Science and GMO Flatt Security.