EUVD-2026-83033
GHSA-4p3q-h8vm-q7v8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated access via an empty-password privileged ONVIF account (AV:N/AC:L/PR:N/UI:N); vendor-described impact is configuration disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information.
AnalysisAI
CM2507 IP cameras expose a privileged ONVIF management account that accepts an empty password, allowing anyone who can reach the camera's ONVIF service to log in with no credentials and read privileged device, user, media-profile, and stream configuration data. The flaw is fully remote, unauthenticated, and low complexity (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality impact and no integrity or availability impact), but its practical reach is bounded by network exposure: the ONVIF service must be directly reachable, which for most deployments means the local LAN segment unless the camera is internet-facing or port-forwarded via UPnP. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the camera's ONVIF management service (TCP, typically ONVIF/SOAP web-service ports), and the attacker uses the privileged account which accepts an empty password - so no credentials are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H, all other impacts N) reflects a fully remote, unauthenticated, low-complexity flaw with high confidentiality impact and no integrity or availability impact - an authentication weakness (CWE-258, hard-coded/empty password) whose described consequence is information disclosure only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed firmware version was identified in the provided intelligence for CVE-2026-84398, so remediation must initially rely on compensating controls; consult advisory ICSA-26-258-08 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-08) and its CSAF copy (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-08.json) for any vendor firmware update or interim guidance that supersedes this assessment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all CareCam HMT CM2507 IP cameras and immediately block external access to their ONVIF service, disable UPnP port forwarding, and move them to an isolated VLAN with deny-by-default firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmt Cm2507 Firmware
View allCleartext storage of wireless network credentials in CM2507 IP cameras running HMT.CM2507 firmware v251211.1507 lets any
CareCam CM2507 IP cameras running firmware v251211.1507 store the root account password as a fixed, legacy hash that off
Physical-access arbitrary code execution on Carecam HMT.CM2507 IP cameras, where firmware automatically runs a predeterm
Unauthenticated access to the network video streaming service in CareCam CM2507 (HMT CM2507) IP cameras exposes live cam
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote de
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an un
Same weakness CWE-258 – Empty Password in Configuration File
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today