Vulnerabilities

TI-2026-56150 CVE-2026-81321 · GHSA-qh37-vv9h-6h8f

CareCam CM2507 Cleartext Storage of Sensitive Information

MEDIUM 42

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00344 Published 2026-09-18 No fix listed CWE-312

TI-2026-58663 CVE-2026-85497 · GHSA-gr8g-35f9-cf37

CareCam CM2507 Use of Password Hash With Insufficient Computational Effort

MEDIUM 48

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00344 Published 2026-09-18 No fix listed CWE-916

TI-2026-58658 CVE-2026-85478 · GHSA-98v9-gfg6-qq55

CareCam CM2507 Missing Authentication for Critical Function

LOW 12

A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication.

CVSS 4.0LOW 2.4 Physical No auth No interaction EPSS 0.00223 Published 2026-09-18 No fix listed CWE-306

TI-2026-56143 CVE-2026-81305 · GHSA-fgvx-jgrc-crhg

CareCam CM2507 Inclusion of Functionality from Untrusted Control Sphere

LOW 33

CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity.

CVSS 4.0HIGH 7.0 Physical No auth No interaction EPSS 0.00278 Published 2026-09-18 No fix listed CWE-829

TI-2026-58011 CVE-2026-84400 · GHSA-5hc2-8482-h9v9

CareCam CM2507 Missing Authentication for Critical Function

LOW 11

CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service.

CVSS 4.0LOW 2.3 Adjacent network No auth No interaction EPSS 0.00207 Published 2026-09-18 No fix listed CWE-306

TI-2026-58009 CVE-2026-84398 · GHSA-4p3q-h8vm-q7v8

CareCam CM2507 Empty Password in Configuration File

MEDIUM 40

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00409 Published 2026-09-18 No fix listed CWE-258

TI-2026-60088 CVE-2026-88259 · GHSA-f9cf-88cq-rm9r

CareCam CM2507 Missing Authentication for Critical Function

MEDIUM 44

CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0052 Published 2026-09-18 No fix listed CWE-306

TI-2026-58445 CVE-2026-85083 · GHSA-988q-pfqj-3hc5

CareCam Pro IP Cameras Use of Hard-coded Credentials

LOW 33

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication.

CVSS 4.0HIGH 7.0 Physical No auth No interaction EPSS 0.00294 Published 2026-09-11 No fix listed CWE-798

Vulnerabilities

Filters