CVE-2026-81321
CriticalCVSS 9.8Summary
CM2507 IP cameras store wireless network credentials in cleartext within the device filesystem.
Risk Assessment
An attacker with filesystem access via physical means or a vulnerability can recover the network SSID and pre-shared key.
Recommendation
Restrict physical access, secure debug interfaces, and encrypt stored credentials.
Other vulnerabilities in CareCam CM2507
See all- CVE-2026-88259High
CareCam CM2507 IP cameras do not require authentication for access to their network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.
- CVE-2026-84400Low
CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who meets certain device state conditions could make this service remotely accessible.
- CVE-2026-85497Critical
CareCam CM2507 IP cameras store the root password using a fixed legacy hash that is insufficiently resistant to offline cracking.
Original NVD description (English source)
CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key.