EUVD-2026-83046
GHSA-98v9-gfg6-qq55
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Bootloader reachable only via physical debug port (AV:P), trivially entered once connected (AC:L) with no auth (PR:N); boot-config/firmware read and modify give limited C:L and I:L, no availability impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.
AnalysisAI
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an unauthenticated debug interface, interrupt the normal boot sequence, and reach an interactive bootloader that can inspect or modify boot configuration, firmware data, and loaded software. The weakness requires hands-on access and a physical connection to the device's debug port, so exploitation is confined to scenarios such as device theft, supply-chain tampering, or unsupervised physical placement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires physical access to the device and a physical connection to its debug interface (e.g., UART/JTAG serial console); the attacker must interrupt the normal boot sequence to reach the interactive bootloader, which then requires no authentication (PR:N) and no user interaction (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low real-world priority despite being a genuine missing-authentication weakness (CWE-306). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is specified in the available intelligence, so the first step is to consult CISA ICS advisory ICSA-26-258-08 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-08) and the matching CSAF record (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-08.json) for any firmware update or vendor-issued mitigation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmt Cm2507 Firmware
View allCleartext storage of wireless network credentials in CM2507 IP cameras running HMT.CM2507 firmware v251211.1507 lets any
CM2507 IP cameras expose a privileged ONVIF management account that accepts an empty password, allowing anyone who can r
CareCam CM2507 IP cameras running firmware v251211.1507 store the root account password as a fixed, legacy hash that off
Physical-access arbitrary code execution on Carecam HMT.CM2507 IP cameras, where firmware automatically runs a predeterm
Unauthenticated access to the network video streaming service in CareCam CM2507 (HMT CM2507) IP cameras exposes live cam
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote de
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today