CVE-2026-84398

HighCVSS 7.5

Published: 18/09/2026(UTC)Updated: 19/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Summary

CM2507 IP cameras accept an empty password for a privileged account exposed through their ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information.

Risk Assessment

Anyone with network access can log into the privileged account without a password and obtain detailed device configuration information, causing a serious security breach.

Recommendation

Set a strong password for the privileged ONVIF account and restrict network access to the camera's management interface.

Other vulnerabilities in CM2507 IP cameras

CVE-2026-81305Medium
CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical access to the device could supply a malicious script and execute arbitrary code in the security context of the affected device.

Original NVD description (English source)

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS