Response discrepancy in EseeCloud lets attackers enumerate devices
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-204.
Summary
Guangzhou Juan IoT Technology EseeCloud App versions 0 through 4.9.6 and EseeCloud Firmware versions 0 through 4.9.86.0 are affected. An endpoint returns a different error code for nonexistent IDs than for valid registered IDs (CWE-204). An attacker holding a valid access token, without further authentication or authorization, can tell valid IDs apart within the 10-digit search space, and the lack of meaningful rate limiting lets them discover registered devices at scale.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization - to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Guangzhou Juan IoT Technology Co., Ltd. | EseeCloud App | up to 4.9.6 | — | No fix listed | CNA |
| Guangzhou Juan IoT Technology Co., Ltd. | EseeCloud Firmware | up to 4.9.86.0 | — | No fix listed | CNA |
- EseeCloud App VendorGuangzhou Juan IoT Technology Co., Ltd. Affected up to 4.9.6 Fixed in — No fix listed CNA
- EseeCloud Firmware VendorGuangzhou Juan IoT Technology Co., Ltd. Affected up to 4.9.86.0 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for EseeCloud App. The sources list no fixed version for EseeCloud Firmware.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-105664
References
More Guangzhou Juan IoT Technology Co., Ltd. vulnerabilities
- TI-2026-75313 Hard-coded credentials in EseeCloud devices allow remote login CVSS 4.0CRITICAL 9.3
- TI-2026-75322 EseeCloud lets attackers take over device binding and read serial IDs CVSS 4.0MEDIUM 6.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences