CISA published advisory ICSA-26-288-02 on 15 October 2026 about three vulnerabilities in EseeCloud, the app and camera firmware from Guangzhou Juan IoT Technology. According to CISA, exploiting them could let an attacker take control of affected IP cameras. The advisory covers the EseeCloud app up to version 4.9.6 and EseeCloud firmware up to 4.9.86.0. It lists no fixed version, because the vendor did not respond to CISA's coordination attempts.
One critical flaw in the camera, two in the cloud
CVE-2026-107617 is the serious one: the devices accept a hard-coded credential, and an attacker can use it to log in. CISA rates it 9.8 (critical) on CVSS 3.1 and 9.3 on CVSS 4.0. The vector is the worst combination: attack over the network, low complexity, no privileges and no user interaction needed.
The other two flaws are in the EseeCloud server.
CVE-2026-97858 concerns device ownership. An attacker can make the server unbind a camera from its current owner and bind it to the attacker's account, even when the camera already belongs to someone else, and learn the device's full serial ID along the way. CISA rates it medium: 5.3 on CVSS 3.1 and 6.9 on CVSS 4.0.
CVE-2026-105664 makes it possible to find those cameras in the first place. The endpoint returns a different error code for an ID that does not exist than for a registered one, and it has no meaningful rate limiting. Anyone holding a valid access token can therefore work through the full 10-digit ID space and discover registered devices at scale. It scores 5.3 on CVSS 3.1 and 8.7 (high) on CVSS 4.0.
Donghyeon Lee of Tokyo University of Science and GMO Flatt Security reported the flaws to CISA. CISA says no public exploitation targeting them has been reported to it so far.
No patch, so limit what the camera can reach
The only vendor-specific advice in the advisory is to contact Guangzhou Juan IoT Technology for support through eseecloud.app. Beyond that, CISA repeats its general recommendations: keep devices off the internet, put them behind a firewall and use a VPN when remote access is needed.
At home that comes down to a few checks. If you set up a camera with the EseeCloud app, remove any port forwarding to it and do not place it in a DMZ. Move it to a separate network for IoT devices, so that anyone who gets into the camera does not land next to your computers and phones. If the router can block internet access for a single device, that also cuts the camera off from the EseeCloud service, at the price of losing remote viewing in the app.
The two cloud-side flaws are not something an owner can fix. The enumeration and rebinding problems sit on the vendor's server, and without a response from Guangzhou Juan IoT Technology it is unclear whether or when they will be addressed.