EUVD-2026-83044
GHSA-fgvx-jgrc-crhg
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access to removable media (AV:P) with no auth or interaction (PR:N/UI:N); unsigned auto-executed script yields full device code execution, so C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
4DescriptionCVE.org
CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical access to the device could supply a malicious script and execute arbitrary code in the security context of the affected device.
AnalysisAI
Physical-access arbitrary code execution on Carecam HMT.CM2507 IP cameras, where firmware automatically runs a predetermined script from attached removable media without verifying its authenticity or integrity. An attacker who can reach the camera's SD/USB interface and insert crafted media can execute code in the device's security context, achieving high confidentiality, integrity and availability impact; the assessed CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no credentials or user interaction are needed once physical access is obtained, and that this is the primary limiting factor since there is no network-facing path to the flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires PHYSICAL access to the camera and the ability to attach removable media (SD/USB) - this is the primary limiting factor (CVSS AV:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but tightly-scoped weakness. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the available data for CVE-2026-81305; consult and monitor the CISA ICS advisory ICSA-26-258-08 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-08) and its CSAF JSON for the vendor's firmware fix or mitigation guidance as it is published, and apply the fixed firmware build as soon as Carecam releases it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Carecam HMT.CM2507 cameras and restrict physical access to their SD/USB interfaces by locking enclosures, using tamper-evident seals, and confirming that removable-media auto-execution is disabled where the firmware supports it; notify security operations and site managers that no public exploit has been identified at time of analysis and that no vendor-released patch is available. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmt Cm2507 Firmware
View allCleartext storage of wireless network credentials in CM2507 IP cameras running HMT.CM2507 firmware v251211.1507 lets any
CM2507 IP cameras expose a privileged ONVIF management account that accepts an empty password, allowing anyone who can r
CareCam CM2507 IP cameras running firmware v251211.1507 store the root account password as a fixed, legacy hash that off
Unauthenticated access to the network video streaming service in CareCam CM2507 (HMT CM2507) IP cameras exposes live cam
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote de
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an un
Share
External POC / Exploit Code
Leaving vuln.today