Which versions of CareCam CM2507 are affected by CVE-2026-85497?

CareCam CM2507 IP cameras running firmware v251211.1507 store the root password as a weak legacy hash, and there is no public exploit identified at time of analysis, but an attacker who obtains the…

How to fix or mitigate CVE-2026-85497?

Within 24 hours, inventory all CareCam CM2507 IP cameras running firmware v251211.1507, isolate them on a dedicated VLAN with strict firewall rules, and disable remote firmware download and debug interfaces. Within 7 days, restrict physical access to devices, prevent public exposure of firmware images, enforce unique strong root credentials if the password can be changed (otherwise assume default credentials are compromised), and deploy monitoring for anomalous authentication attempts or credential reuse. Within 30 days, escalate to the vendor for a patch timeline, evaluate replacing affected cameras with models that do not use fixed password hashes, and conduct a risk assessment to determine if the shared root credential risk justifies immediate replacement. No vendor-released patch identified at time of analysis, so these interim measures are critical to reduce exposure.

CareCam CM2507 CVE-2026-85497

Q: What is the CVSS score of CVE-2026-85497?

CVE-2026-85497 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-83049 CRITICAL

Use of Password Hash With Insufficient Computational Effort (CWE-916)

2026-09-18 icscert

GHSA-gr8g-35f9-cf37

Information Disclosure Hmt Cm2507 Firmware

9.3

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

AC:H reflects the required firmware/hash acquisition plus offline cracking of the legacy hash; a recovered root credential grants full device control, so C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 18, 2026 - 17:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 18, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Sep 18, 2026 - 17:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Sep 18, 2026 - 17:06 vuln.today

CVE Published

Sep 18, 2026 - 16:19 cve.org

CRITICAL 9.8

DescriptionCVE.org

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.

AnalysisAI

CareCam CM2507 IP cameras running firmware v251211.1507 store the root account password as a fixed, legacy hash that offers insufficient resistance to offline cracking, so anyone who obtains the firmware image or the on-device password database can potentially recover the root credential. The exposure is not a single-step remote compromise: the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, because an attacker must first acquire the hash artifact (vendor firmware download, physical/debug filesystem access, or a chained bug) and then crack it offline, and the recovered credential is only useful if it remains valid and is genuinely shared across the firmware line - the advisory says cross-device reuse 'may' occur rather than confirming it. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to FIRST obtain the CM2507 firmware image or the on-device password database (e.g., via vendor firmware download, physical/debug filesystem access, or a chained vulnerability), then perform OFFLINE brute-force/dictionary cracking of the fixed legacy hash for the device root account. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch is identified in the available advisory data at time of analysis, so operators should treat the exposure as requiring compensating controls rather than waiting on a firmware fix. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all CareCam CM2507 IP cameras running firmware v251211.1507, isolate them on a dedicated VLAN with strict firewall rules, and disable remote firmware download and debug interfaces. …

Threat intelligence, references, and detailed analysis are available after sign-in.