CVE-2026-85497
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
CareCam CM2507 IP cameras store the root password using a fixed legacy hash that is insufficiently resistant to offline cracking.
Risk Assessment
An attacker with firmware or password database access can recover credentials, potentially reused across other devices.
Recommendation
Change the password to a unique strong one and update firmware if a patch is available.
Other vulnerabilities in CareCam CM2507
See all- CVE-2026-81321Critical
CM2507 IP cameras store wireless network credentials in cleartext within the device filesystem.
- CVE-2026-88259High
CareCam CM2507 IP cameras do not require authentication for access to their network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.
- CVE-2026-84400Low
CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who meets certain device state conditions could make this service remotely accessible.
Original NVD description (English source)
CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS