eSeeCloud CVE-2026-97858

The target device must be managed through the eSeeCloud cloud platform's device bind/unbind workflow; the flaw is that the server performs an ownership rebind without validating that the requester currently owns the device, so exploitation works even when the device is actively bound to a different account (CWE-915, improperly controlled modification of object attributes). No special configuration, authentication, or user interaction is required per the CVSS vector (PR:N/UI:N/AC:L). The practical limiting factor is that the attacker must be able to reach the cloud service and address a specific target device (e.g., know or enumerate its binding identifier); impact is bounded to ownership takeover and disclosure of the device serial ID rather than broader data access.

This is a medium-severity information disclosure/integrity-of-ownership issue (CVSS 4.0 base 6.9) in the eSeeCloud device-management platform, disclosed via CISA ICS advisory ICSA-26-288-02. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, and the impact metrics (VC:L/VI:N/VA:N) scope the damage to a LOW confidentiality impact only - specifically leakage of a device's full serial ID - with no integrity or availability impact recorded despite the fact that the attacker also forcibly re-binds the device to their own account (an ownership change the vector arguably under-weights on VI). Exploitation signals are weak-to-absent: there is no CISA KEV listing, no POC, and no EPSS value supplied, so there is no public exploit identified at time of analysis. The realistic priority is MODERATE: the unauthenticated network attack surface and low complexity make it attractive, but the confirmed impact is limited to serial-ID disclosure and ownership hijack of IoT/OT camera-class devices rather than direct code execution or data-at-rest compromise. Note a conflict worth verifying with the vendor: the mechanism (unbinding a device from another owner and rebinding it to the attacker) is a device-takeover/ownership-integrity problem, yet the CVSS sets VI:N and the only tag is 'Information Disclosure' - the real-world impact may be broader than a pure disclosure classification implies.

An attacker interacts with the eSeeCloud cloud service over the network and issues a device bind request for a target device that is already registered to a legitimate owner; the server unbinds it from that owner and binds it to the attacker's account, returning the device's full serial ID. No authentication to the victim's account, no user interaction, and no POC are required or known. With the serial ID and new binding, the attacker can enumerate or assert control over the targeted device.