Login Request a demo
Medium severity · published Oct 16, 2026
CVE-2026-97858
Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
EseeCloud App · Guangzhou Juan IoT Technology Co., Ltd.
through 4.9.6 · source: vendor
EF
EseeCloud Firmware · Guangzhou Juan IoT Technology Co., Ltd.
through 4.9.86.0 · source: vendor
In the news
VulnerabilityCritical
Guangzhou Juan IoT Technology EseeCloud
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App <=4.9.6 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664) EseeCloud Firmware <=4.9.86.0 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664) CVSS Vendor Equipment v3 9.8 Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App 3 Vulnerabilities Use of Hard-coded Credentials, Improperly Controlled Modification of Dynamically-Determined Object Attributes, Observable Response Discrepancy Background Critical Infrastructure Sectors: Energy, Communications, Transportation Systems, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-107617 An attacker can use a hard-coded credential to log in to EseeCloud devices. Read More 2 Affected Products Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App: <=4.9.6 Product Status: known_affected Remediations Mitigation Guangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/. Guangzhou Juan IoT Technology Co., Ltd. EseeC...
CVE-2026-107617CVE-2026-97858CVE-2026-105664
Oct 15, 2026·CISA Advisories
Affected product
EA
EseeCloud App
Guangzhou Juan IoT Technology Co., Ltd.
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97858
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-97858
eseecloud.app
https://eseecloud.app/
github.com
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02
More from EseeCloud App
9.8
CVE-2026-107617
Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials
5.3
CVE-2026-105664
Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy