EUVD-2026-102878
GHSA-75pm-gcg3-4jf4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EseeCloud device over network
-
ExploitSubmit hard-coded credential
-
ExecutionAuthenticate as privileged user
-
ImpactGain full device control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - a remote unauthenticated attacker can log in to EseeCloud devices using an embedded hard-coded credential (CWE-798) without any valid account. The primary limiting factor is network exposure of the device management/login interface: devices isolated behind NAT, firewalls, or not reachable from the attacker's network segment are not directly exploitable, but internet-exposed or cloud-reachable units are fully exposed. No user interaction or non-default configuration is required. |
| Impact | All available signals point to a genuinely high-priority, easy-to-exploit flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the CWE-798 classification describe a hard-coded credential reachable over the network with low complexity, no attacker privileges, and no user interaction, yielding full confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) - consistent with the 9.3 Critical base score. This was reported by CISA/ICS-CERT (ics-cert@hq.dhs.gov) and published as ICS advisory ICSA-26-288-02, which lends high credibility to the technical findings. However, no EPSS probability, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no confirmation of active exploitation. The practical risk is therefore driven by how trivial hard-coded credentials are to abuse once disclosed (a single static secret works across all affected units) rather than by evidence of current mass exploitation; absence of EPSS/KEV data is a data gap, not evidence of low real-world risk. |
| Exploit ScenarioDerived | An attacker who can reach an EseeCloud device's management interface over the network supplies the embedded hard-coded credential and authenticates directly as a privileged user, with no legitimate account or user interaction required. Because the credential is static across devices, the same login works against every affected unit, enabling full control of the camera/NVR surveillance device. No public exploit code is identified at time of analysis, but exploitation requires only knowledge of the static credential. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Remote authentication bypass in EseeCloud devices lets an unauthenticated attacker log in to the device management/login interface using a credential hard-coded into the product, yielding full control of the device (CVSS 4.0 base 9.3; independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every condition for exploitation is attacker-friendly: no account, no user interaction, no non-default configuration, and no special network position beyond reachability of the management interface, so internet-exposed or cloud-reachable units are effectively open doors while NAT/firewall-isolated devices are shielded. No public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data at time of analysis, and no EPSS score was provided, but the credential is embedded in the firmware rather than guessed, so the barrier to abuse is low wherever the interface is reachable. The flaw was reported to CISA's ICS-CERT program and published as advisory ICSA-26-288-02 under the Authentication Bypass tag.
RemediationAI
No vendor-released patch, fix version, or CVE-specific firmware build is identified in the available advisory data, and the CISA ICS-CERT advisory ICSA-26-288-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02) plus the vendor site https://eseecloud.app/ are the first places to check for an updated firmware image or credential-rotation guidance; if a fixed build is published, apply it fleet-wide and assume the old shared credential must be considered compromised on every unit that ran the vulnerable firmware. Until then, the highest-value compensating control is removing reachability: block inbound access to the device management/login ports at the network perimeter, disable UPnP and P2P/port-forwarding features that punch holes for remote viewing, and place cameras on a dedicated VLAN with no outbound path to the corporate LAN - the trade-off is that remote/cloud viewing and NAT-traversal convenience stop working and users must reach devices through a VPN or a hardened broker. If the eseecloud.app cloud path is not operationally required, deny device and client egress to that service, accepting loss of mobile remote access in exchange for eliminating the cloud-proxied entry point. Restrict and rotate any account credentials used alongside the device (NVR, cloud tenant, video management system), monitor authentication logs for logins using the embedded account or from unexpected source addresses, and treat any device without a vendor-supported fixed firmware as a replacement candidate; do not rely on changing the device's own admin password as a mitigation because a firmware-resident hard-coded credential is not user-configurable and will continue to satisfy authentication.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-798, Use of Hard-coded Credentials: EseeCloud firmware ships with a fixed account/password pair (or equivalent static authentication secret) that is identical across devices and cannot be changed by the device owner through normal configuration. Because authentication is satisfied by a value the attacker already possesses rather than by a secret-derived challenge, the login path collapses into a straight credential replay, which explains the CVSS vector's AV:N/AC:L/PR:N/UI:N with High Confidentiality, Integrity and Availability impact - an attacker who reaches the interface authenticates as a privileged user without ever holding a valid account. EseeCloud is a consumer/SMB IP camera and video-surveillance ecosystem in which devices are provisioned through the eseecloud.app cloud service and companion mobile applications, so the practical attack surface is the device's local HTTP/management service, any P2P/UPnP-assisted remote path the device advertises, and the cloud service endpoints that proxy to the device. No CPE identifiers or firmware version ranges were supplied in the available NVD and ICS-CERT data, so the exact affected firmware builds are not enumerable from this source set; the advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02-02 is the authoritative reference for the affected product/version list. Hard-coded credentials carry a compounding supply-chain risk here: because the same secret is shared fleet-wide, a single extraction from one device or firmware image exposes every reachable unit of that model, and remediation on the device side may require a firmware update that rotates the credential rather than merely a password change.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Static hard-coded credential is usable remotely with no attacker privileges or interaction (AV:N/AC:L/PR:N/UI:N), granting full device control, hence C:H/I:H/A:H.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
DescriptionCVE.org
An attacker can use a hard-coded credential to log in to EseeCloud devices.
Executive ViewAI
EseeCloud cameras and recorders contain a critical authentication bypass (CVE-2026-107617) that lets anyone who can simply reach the device management interface log in with a credential embedded in the firmware and take full control - no account, password, or user action required. Every unit that is internet-exposed or reachable from a broad network segment is effectively an open door, putting surveillance footage, physical-security operations, and any network the device can pivot into at risk, while the flaw is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and no vendor-released patch has been identified at time of analysis. Because the hard-coded credential cannot be changed or patched around, leadership should treat this as an asset-inventory and network-isolation problem rather than a routine patch-management task.
No vendor-released patch has been issued yet; interim mitigations are network-based: remove or block internet and cloud access to the device management/login interface, isolate devices on a dedicated VLAN segmented from corporate, OT, and cloud networks, restrict access to trusted source IPs only, disable UPnP and unnecessary remote-viewing services, monitor authentication logs for anomalous logins, and replace or decommission units that cannot be isolated until a firmware fix is published.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB