CVE-2026-107617: EseeCloud Hard-Coded Credential (pending)

Checked: 2026-10-22

Not indexed yetThis page does not yet have enough independently analysed data (no NVD CVSS/CPE assessment, and it is not in the CISA KEV catalog) to publish as a reviewed advisory, so it is marked noindex and left out of the sitemap until more data is confirmed.

CVE-2026-107617 is a hard-coded credential in EseeCloud, the app and firmware behind Guangzhou Juan IoT Technology's consumer IP cameras, that lets an attacker log in to affected devices remotely; the vendor did not respond to CISA's coordination attempts, and NVD has not yet completed its own CVSS scoring, so this page stays noindex pending both a vendor fix and NVD analysis.

Vulnerability summary

Vulnerability ID	CVE-2026-107617
CVSS score	Not yet scored by NVD
EPSS score	0.00325
CISA KEV	No
Source	NVD
Published	2026-10-16T14:17:16.510

Affected components

Component	CPE	Version range
Guangzhou Juan IoT Technology EseeCloud	—	EseeCloud App 4.9.6 and prior; EseeCloud Firmware 4.9.86.0 and prior; not yet a published NVD CPE applicability statement

What this means

CVE-2026-107617 is a use of hard-coded credentials vulnerability (CWE-798) in EseeCloud, the mobile app and device firmware that Guangzhou Juan IoT Technology ships with its consumer IP cameras. CISA's advisory states plainly that "an attacker can use a hard-coded credential to log in to EseeCloud devices" (CISA ICS Advisory ICSA-26-288-02).

NVD tracks CVE-2026-107617 with status "Deferred" as of 2026-10-22: its record carries a CNA-submitted CVSS v3.1 score of 9.8 (critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.3, but NVD has not itself analyzed or confirmed the score or published a CPE applicability statement, so this page leaves cvss_score unset rather than presenting the submitted figure as NVD-confirmed (NVD).

CISA's advisory reports that the vendor, Guangzhou Juan IoT Technology, "did not respond to CISA's coordination efforts" for this and two related EseeCloud CVEs (CVE-2026-97858, CVE-2026-105664) disclosed in the same advisory, and that no patched version is confirmed; CISA's only guidance is to contact the manufacturer directly through its support site (CISA ICS Advisory ICSA-26-288-02). The affected versions are EseeCloud App 4.9.6 and earlier, and EseeCloud Firmware 4.9.86.0 and earlier.

CISA's advisory reports no known public exploitation of this CVE as of its release. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.00325 (24.3rd percentile) (CISA KEV, FIRST EPSS).

Because the vendor has not confirmed a fix and NVD has not completed its own analysis, this page does not meet the minimum data bar for indexing. Owners of affected EseeCloud cameras should isolate them from untrusted networks and contact the manufacturer, since no software remediation is confirmed as available.

How to fix this class of issueThis advisory's weakness class is Hard-coded credentials. Our practical guide covers how to detect, fix, verify and disclose it: How to fix hard-coded credentials in embedded firmware.

Evidence

EseeCloud app/firmware contains a hard-coded credential that lets an attacker log in to affected devices (CWE-798). — CISA ICS Advisory ICSA-26-288-02
NVD status is "Deferred" with a CNA-submitted CVSS v3.1 score of 9.8 and CVSS v4.0 9.3; no NVD-published score or CPE configuration as of 2026-10-22. — NVD
Vendor Guangzhou Juan IoT Technology did not respond to CISA's coordination efforts; no confirmed patched version; affects EseeCloud App ≤4.9.6 and Firmware ≤4.9.86.0. — CISA ICS Advisory ICSA-26-288-02
Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
EPSS score is 0.00325 (24.3rd percentile) as of 2026-10-22. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.CVE-2025-62593: Ray AI Compute Engine Browser-to-RCE via DNS Rebinding (KEV)CVE-2025-62593: KEV code injection in Ray lets an attacker combine DNS rebinding with a Firefox/Safari User-Agent spoof to reach a developer's local Ray dashboard and run arbitrary code. Sourced to NVD, CISA and Ray-Project.