EUVD-2026-83040
GHSA-5hc2-8482-h9v9
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent LAN access (AV:A); the required device-state precondition maps to AC:H; no auth or interaction (PR:N/UI:N); impact limited to enabling access, so I:L only with C:N/A:N.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions could make the service remotely accessible, increasing the risk of unauthorized administrative access.
AnalysisAI
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote debugging service, and an attacker positioned on the same local network who is able to satisfy certain device-state conditions could make that debugging endpoint remotely reachable and use it to obtain unauthorized administrative access. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV does not list this CVE); EPSS data was not supplied. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) network adjacency - the attacker must be on the same local network as the camera (AV:A), not remote-internet reachable by default; (2) a specific, unspecified device state that unlocks the 'network maintenance mechanism' capable of activating the remote debugging service (reflected as attack requirement AT:P); and (3) the CM2507 firmware being in its vulnerable, un-patched configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-priority, low-real-risk issue despite being an ICS advisory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the CISA advisory ICSA-26-258-08 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-08) and its CSAF copy (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-08.json) are the places to check for a firmware fix, so contact the vendor and monitor that advisory for the exact patched firmware version before assuming any build is clean. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmt Cm2507 Firmware
View allCleartext storage of wireless network credentials in CM2507 IP cameras running HMT.CM2507 firmware v251211.1507 lets any
CM2507 IP cameras expose a privileged ONVIF management account that accepts an empty password, allowing anyone who can r
CareCam CM2507 IP cameras running firmware v251211.1507 store the root account password as a fixed, legacy hash that off
Physical-access arbitrary code execution on Carecam HMT.CM2507 IP cameras, where firmware automatically runs a predeterm
Unauthenticated access to the network video streaming service in CareCam CM2507 (HMT CM2507) IP cameras exposes live cam
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an un
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today