Source: cisa.gov
CISA has published an ICS advisory for Guangzhou Juan IoT Technology EseeCloud, affecting both the EseeCloud App (<=4.9.6) and EseeCloud Firmware (<=4.9.86.0). Three vulnerabilities were identified: CVE-2026-107617 (Use of Hard-coded Credentials, CVSS 9.8 Critical), CVE-2026-97858 (Improperly Controlled Modification of Dynamically-Determined Object Attributes, CVSS 5.3 Medium), and CVE-2026-105664 (Observable Response Discrepancy enabling device enumeration, CVSS 5.3/8.7). Successful exploitation could allow attackers to gain full control over affected IP cameras, hijack device ownership, or enumerate registered devices at scale. The vulnerabilities affect critical infrastructure sectors worldwide including Energy, Communications, Transportation, Financial Services, and Government. The vendor did not respond to CISA's coordination attempts, leaving no official patch available. Users are advised to minimize network exposure, use firewalls, and employ VPNs for remote access. Vulnerabilities were reported by Donghyeon Lee of Tokyo University of Science and GMO Flatt Security.
