Hmt Cm2507 Firmware
Monthly
Cleartext storage of wireless network credentials in CM2507 IP cameras running HMT.CM2507 firmware v251211.1507 lets anyone who already holds the device's filesystem read the configured SSID and pre-shared key directly, with no cracking, decryption, or privilege escalation required once that access exists. Reaching the filesystem requires physical possession of the camera, use of an exposed on-board debugging interface, or chaining a separate vulnerability; it is not remotely reachable against a default network-facing configuration. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, and the vendor's CVSS 4.0 score of 9.3 (AV:N) materially overstates real-world risk - our independent assessment scores it CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (approximately 3.7, Low), since impact is confined to disclosure of stored Wi-Fi credentials with no integrity or availability effect on the camera itself.
CareCam CM2507 IP cameras running firmware v251211.1507 store the root account password as a fixed, legacy hash that offers insufficient resistance to offline cracking, so anyone who obtains the firmware image or the on-device password database can potentially recover the root credential. The exposure is not a single-step remote compromise: the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, because an attacker must first acquire the hash artifact (vendor firmware download, physical/debug filesystem access, or a chained bug) and then crack it offline, and the recovered credential is only useful if it remains valid and is genuinely shared across the firmware line - the advisory says cross-device reuse 'may' occur rather than confirming it. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the vendor's CVSS 4.0 score of 9.3 overstates real-world risk relative to the assessed vector.
Physical-access arbitrary code execution on Carecam HMT.CM2507 IP cameras, where firmware automatically runs a predetermined script from attached removable media without verifying its authenticity or integrity. An attacker who can reach the camera's SD/USB interface and insert crafted media can execute code in the device's security context, achieving high confidentiality, integrity and availability impact; the assessed CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no credentials or user interaction are needed once physical access is obtained, and that this is the primary limiting factor since there is no network-facing path to the flaw. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV - exploitation requires an attacker with hands-on access to the hardware.
CM2507 IP cameras expose a privileged ONVIF management account that accepts an empty password, allowing anyone who can reach the camera's ONVIF service to log in with no credentials and read privileged device, user, media-profile, and stream configuration data. The flaw is fully remote, unauthenticated, and low complexity (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality impact and no integrity or availability impact), but its practical reach is bounded by network exposure: the ONVIF service must be directly reachable, which for most deployments means the local LAN segment unless the camera is internet-facing or port-forwarded via UPnP. No public exploit code was identified in the available intelligence and there is no indication of confirmed active exploitation (not listed in CISA KEV); CISA ICS-CERT published advisory ICSA-26-258-08 covering the CareCam HMT CM2507 firmware line.
Unauthenticated access to the network video streaming service in CareCam CM2507 (HMT CM2507) IP cameras exposes live camera video to anyone who can reach the device across the network. Because the streaming endpoint ships with no authentication requirement at all (CWE-306), a remote attacker needs only network reachability - no credentials, no user interaction, and no special mode or configuration - to pull the live feed. The realistic blast radius is bounded by exposure and product footprint rather than by exploit difficulty: devices that are internet-facing or reachable through port forwarding are the ones at genuine risk, while units isolated on a dedicated LAN/VLAN are far less exposed. No public exploit code has been identified at the time of analysis, no confirmed active exploitation is indicated by the available intelligence, and CISA ICS-CERT has published advisory ICSA-26-258-08 describing the issue.
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an unauthenticated debug interface, interrupt the normal boot sequence, and reach an interactive bootloader that can inspect or modify boot configuration, firmware data, and loaded software. The weakness requires hands-on access and a physical connection to the device's debug port, so exploitation is confined to scenarios such as device theft, supply-chain tampering, or unsupervised physical placement. It carries a low CVSS base score of 3.5, no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the available intelligence.
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote debugging service, and an attacker positioned on the same local network who is able to satisfy certain device-state conditions could make that debugging endpoint remotely reachable and use it to obtain unauthorized administrative access. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV does not list this CVE); EPSS data was not supplied. Severity is low - the vendor-published CVSS 4.0 base score is 2.3 (AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N) and our independent assessment scores it CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - because exploitation demands LAN adjacency plus an unspecified device-state prerequisite and the immediate consequence is limited to enabling further access rather than full compromise.
Cleartext storage of wireless network credentials in CM2507 IP cameras running HMT.CM2507 firmware v251211.1507 lets anyone who already holds the device's filesystem read the configured SSID and pre-shared key directly, with no cracking, decryption, or privilege escalation required once that access exists. Reaching the filesystem requires physical possession of the camera, use of an exposed on-board debugging interface, or chaining a separate vulnerability; it is not remotely reachable against a default network-facing configuration. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, and the vendor's CVSS 4.0 score of 9.3 (AV:N) materially overstates real-world risk - our independent assessment scores it CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (approximately 3.7, Low), since impact is confined to disclosure of stored Wi-Fi credentials with no integrity or availability effect on the camera itself.
CareCam CM2507 IP cameras running firmware v251211.1507 store the root account password as a fixed, legacy hash that offers insufficient resistance to offline cracking, so anyone who obtains the firmware image or the on-device password database can potentially recover the root credential. The exposure is not a single-step remote compromise: the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, because an attacker must first acquire the hash artifact (vendor firmware download, physical/debug filesystem access, or a chained bug) and then crack it offline, and the recovered credential is only useful if it remains valid and is genuinely shared across the firmware line - the advisory says cross-device reuse 'may' occur rather than confirming it. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the vendor's CVSS 4.0 score of 9.3 overstates real-world risk relative to the assessed vector.
Physical-access arbitrary code execution on Carecam HMT.CM2507 IP cameras, where firmware automatically runs a predetermined script from attached removable media without verifying its authenticity or integrity. An attacker who can reach the camera's SD/USB interface and insert crafted media can execute code in the device's security context, achieving high confidentiality, integrity and availability impact; the assessed CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no credentials or user interaction are needed once physical access is obtained, and that this is the primary limiting factor since there is no network-facing path to the flaw. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV - exploitation requires an attacker with hands-on access to the hardware.
CM2507 IP cameras expose a privileged ONVIF management account that accepts an empty password, allowing anyone who can reach the camera's ONVIF service to log in with no credentials and read privileged device, user, media-profile, and stream configuration data. The flaw is fully remote, unauthenticated, and low complexity (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality impact and no integrity or availability impact), but its practical reach is bounded by network exposure: the ONVIF service must be directly reachable, which for most deployments means the local LAN segment unless the camera is internet-facing or port-forwarded via UPnP. No public exploit code was identified in the available intelligence and there is no indication of confirmed active exploitation (not listed in CISA KEV); CISA ICS-CERT published advisory ICSA-26-258-08 covering the CareCam HMT CM2507 firmware line.
Unauthenticated access to the network video streaming service in CareCam CM2507 (HMT CM2507) IP cameras exposes live camera video to anyone who can reach the device across the network. Because the streaming endpoint ships with no authentication requirement at all (CWE-306), a remote attacker needs only network reachability - no credentials, no user interaction, and no special mode or configuration - to pull the live feed. The realistic blast radius is bounded by exposure and product footprint rather than by exploit difficulty: devices that are internet-facing or reachable through port forwarding are the ones at genuine risk, while units isolated on a dedicated LAN/VLAN are far less exposed. No public exploit code has been identified at the time of analysis, no confirmed active exploitation is indicated by the available intelligence, and CISA ICS-CERT has published advisory ICSA-26-258-08 describing the issue.
Physical access to a CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 lets an attacker connect to an unauthenticated debug interface, interrupt the normal boot sequence, and reach an interactive bootloader that can inspect or modify boot configuration, firmware data, and loaded software. The weakness requires hands-on access and a physical connection to the device's debug port, so exploitation is confined to scenarios such as device theft, supply-chain tampering, or unsupervised physical placement. It carries a low CVSS base score of 3.5, no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the available intelligence.
CareCam CM2507 IP cameras expose an insufficiently protected network maintenance mechanism that can activate a remote debugging service, and an attacker positioned on the same local network who is able to satisfy certain device-state conditions could make that debugging endpoint remotely reachable and use it to obtain unauthorized administrative access. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV does not list this CVE); EPSS data was not supplied. Severity is low - the vendor-published CVSS 4.0 base score is 2.3 (AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N) and our independent assessment scores it CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - because exploitation demands LAN adjacency plus an unspecified device-state prerequisite and the immediate consequence is limited to enabling further access rather than full compromise.