CareCam CM2507

CISA issued an advisory for CareCam CM2507 IP cameras running firmware v251211.1507, disclosing seven vulnerabilities. The flaws include missing authentication for live video streaming (CVE-2026-88259), empty password on the ONVIF management service (CVE-2026-84398), an unprotected remote debugging activation mechanism (CVE-2026-84400), arbitrary code execution via unverified removable media scripts (CVE-2026-81305), an unauthenticated physical debug interface exposing the bootloader (CVE-2026-85478), weak password hashing for the root account (CVE-2026-85497), and cleartext storage of wireless credentials (CVE-2026-81321). CVSS v4.0 scores range from 2.3 to 9.3, with two vulnerabilities rated CRITICAL. CareCam has not responded to CISA coordination attempts, leaving no vendor patch available. Users are advised to isolate devices behind firewalls, minimize network exposure, and use VPNs for remote access. No public exploitation has been reported at the time of publication.