CVE-2026-84400
LowCVSS 3.1Summary
CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who meets certain device state conditions could make this service remotely accessible.
Risk Assessment
This increases the risk of unauthorized administrative access to the cameras, potentially leading to device takeover and privacy breaches. The attack requires local network access and specific device conditions.
Recommendation
Check for and apply firmware updates for CareCam CM2507 cameras. Restrict local network access and disable unused remote maintenance services if possible.
Other vulnerabilities in CareCam CM2507
See all- CVE-2026-88259High
CareCam CM2507 IP cameras do not require authentication for access to their network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.
- CVE-2026-85497Critical
CareCam CM2507 IP cameras store the root password using a fixed legacy hash that is insufficiently resistant to offline cracking.
- CVE-2026-81321Critical
CM2507 IP cameras store wireless network credentials in cleartext within the device filesystem.
Original NVD description (English source)
CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions could make the service remotely accessible, increasing the risk of unauthorized administrative access.