EUVD-2026-83029
GHSA-f9cf-88cq-rm9r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable streaming service (AV:N/AC:L/PR:N/UI:N) exposes live video (C:H) with no integrity or availability impact and no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.
AnalysisAI
Unauthenticated access to the network video streaming service in CareCam CM2507 (HMT CM2507) IP cameras exposes live camera video to anyone who can reach the device across the network. Because the streaming endpoint ships with no authentication requirement at all (CWE-306), a remote attacker needs only network reachability - no credentials, no user interaction, and no special mode or configuration - to pull the live feed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected feature is the CM2507's network video streaming service, which ships without any authentication requirement - this IS the vulnerable condition, not an optional misconfiguration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority for anyone operating the affected device, though its blast radius is constrained by product footprint rather than by exploit difficulty. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the CISA advisory ICSA-26-258-08 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-08) is the reference to monitor for a firmware update, and it should be re-checked before assuming a fix remains unavailable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all CareCam CM2507 (HMT CM2507) IP cameras, determine which are internet-facing or reachable through port forwarding, and immediately block external access via firewall rules or removal of port forwarding. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmt Cm2507 Firmware
View allCleartext storage of wireless network credentials in CM2507 IP cameras running HMT.CM2507 firmware v251211.1507 lets any
CM2507 IP cameras expose a privileged ONVIF management account that accepts an empty password, allowing anyone who can r
CareCam CM2507 IP cameras running firmware v251211.1507 store the root account password as a fixed, legacy hash that off
Physical-access arbitrary code execution on Carecam HMT.CM2507 IP cameras, where firmware automatically runs a predeterm
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote de
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an un
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today