CareCam Camera Flaws Open Paths to Live Video, Root Access and Wi-Fi Credential Theft

Seven vulnerabilities in the CareCam CM2507 IP camera expose functions ranging from unauthenticated video streaming to arbitrary code execution and recovery of wireless network credentials.

The affected product runs CareCam HMT.CM2507 Firmware v251211.1507, which is classified as known_affected. No corrected firmware version or vendor-provided workaround has been identified.

The weaknesses affect different trust boundaries. Some are remotely exploitable without credentials, while others require local-network reachability, filesystem access or physical control of the camera. Used together, they could allow an attacker to move from surveillance and management access to persistent device compromise or intrusion into the connected wireless network.

CareCam is headquartered in China. Its cameras are deployed worldwide and are associated with the Commercial Facilities critical-infrastructure sector. Ben Law reported the findings to CISA.

Two network flaws expose video and privileged management functions

The most immediate risks come from services that can be reached over a network without valid authentication.

CVE-2026-88259 affects the camera’s network video streaming service. The CM2507 provides live video without first verifying the requester’s identity, allowing anyone who can reach the service to retrieve the camera feed.

The flaw is categorized as CWE-306, Missing Authentication for Critical Function. It received a CVSS v3.1 score of 7.5 HIGH and a CVSS v4.0 score of 8.7 HIGH. Exploitation requires no privileges, user interaction or unusual conditions.

The result is a direct loss of video confidentiality. Depending on where a camera is installed, an exposed stream could reveal occupants, working patterns, physical-security controls or activity inside a commercial facility.

CVE-2026-84398 creates a separate route into the ONVIF management service. A privileged account accepts an empty password, enabling a network attacker to access management functions without knowing a credential.

Through that account, an attacker may obtain details about the device, configured users, media profiles and stream settings. This issue is classified as CWE-258, Empty Password in Configuration File, and carries the same scores as the video flaw: 7.5 HIGH under CVSS v3.1 and 8.7 HIGH under CVSS v4.0.

These vulnerabilities do not depend on phishing or another user action. Network reachability is the principal requirement.

Maintenance and physical interfaces expand the attack surface

Three additional vulnerabilities expose debugging, removable-media and bootloader functionality.

CVE-2026-84400 concerns an inadequately protected network maintenance mechanism. Under specified device-state conditions, an attacker on the same local network may use it to make a remote debugging service accessible. That interface could then increase the likelihood of unauthorized administrative operations.

The flaw requires adjacent-network access. Its CVSS v3.1 score is 3.1 LOW, reflecting high attack complexity, while its CVSS v4.0 score is 2.3 LOW and includes a physical attack requirement in the vector. The exact device-state conditions needed for exploitation have not been disclosed.

Physical access creates more powerful options.

With CVE-2026-81305, the camera automatically executes a predetermined script found on removable media without verifying its authenticity or integrity. An attacker able to connect prepared media can therefore run malicious code in the device’s security context.

No account or user interaction is required after physical access has been obtained. The vulnerability, categorized as CWE-829, could compromise confidentiality, integrity and availability. It is rated 6.8 MEDIUM under CVSS v3.1 and 7.0 HIGH under CVSS v4.0.

CVE-2026-85478 exposes an interactive bootloader through a physical debugging interface without authentication. An attacker can interrupt the normal boot sequence and inspect or change boot configuration, firmware data and software loaded by the camera.

This bootloader weakness has a CVSS v3.1 score of 3.5 LOW and a CVSS v4.0 score of 2.4 LOW. Although its scores are lower than those of the remote flaws, access to the boot chain can support analysis, modification and persistence that ordinary management controls may not detect.

Weak storage protections put root and Wi-Fi credentials at risk

The two highest CVSS v4.0 ratings concern secrets stored on the camera.

CVE-2026-85497 results from the use of a fixed legacy hash for the root-account password. The hashing mechanism does not impose enough computational cost to provide adequate resistance against offline cracking.

An attacker who obtains the firmware image or password database may recover the underlying root credential. If cameras running the same firmware use identical or reused credentials, the recovered password could also work against additional devices.

The issue is classified as CWE-916, Use of Password Hash With Insufficient Computational Effort. It received 7.5 HIGH under CVSS v3.1 and 9.3 CRITICAL under CVSS v4.0, with the newer scoring assessment treating potential confidentiality, integrity and availability effects as high.

CVE-2026-81321 exposes the wireless network identifier and pre-shared key because the camera stores them in cleartext within its filesystem. An attacker must first obtain filesystem access, potentially through physical control, a debugging interface or another vulnerability.

Once recovered, the credentials could provide access to the wireless network used by the camera. Rotating the camera’s administrative password alone would not address that secondary exposure.

This cleartext-storage flaw, categorized as CWE-312, is also rated 7.5 HIGH under CVSS v3.1 and 9.3 CRITICAL under CVSS v4.0. The reported network-based vectors reflect the consequences of obtaining and using the secrets, even though retrieving the filesystem may require a separate access path.

Chaining the flaws could turn one camera into a broader foothold

The seven findings are more consequential when considered as connected attack paths rather than isolated defects.

A remote attacker could begin by viewing live video through CVE-2026-88259 or querying privileged ONVIF functions through CVE-2026-84398. An attacker already on the local network might also attempt to expose the debugging service affected by CVE-2026-84400.

Physical access enables deeper compromise. Malicious removable media can trigger code execution through CVE-2026-81305, while the unauthenticated bootloader in CVE-2026-85478 permits inspection or alteration of low-level device components.

Those access paths may facilitate extraction of the password database or filesystem. The attacker could then crack the weak root-password hash covered by CVE-2026-85497 and retrieve cleartext Wi-Fi credentials through CVE-2026-81321.

The consequences may extend beyond one camera. A shared root password could expose other CM2507 devices using the same firmware credentials, while a recovered wireless pre-shared key could provide access to systems on the associated network.

No corrective firmware has been identified

As of September 16, 2026, no vendor firmware update, fixed release or product-specific workaround has been identified. It is also not known whether CM2507 firmware versions other than HMT.CM2507 Firmware v251211.1507 are affected.

CISA recommends reducing network exposure and ensuring that the cameras are not directly reachable from the internet. Camera networks should be separated from business systems and placed behind firewalls. Where remote administration is unavoidable, access should pass through an updated VPN and tightly controlled endpoints.

Organizations should also:

• Restrict access to ONVIF, streaming and maintenance services.
• Monitor for unexpected video connections and ONVIF requests.
• Detect newly exposed debugging services or abnormal maintenance traffic.
• Control removable-media use and inspect cameras for unauthorized attachments.
• Protect debugging connectors, bootloader access and nearby network equipment.
• Watch for firmware, software or boot-configuration changes.
• Treat firmware images, filesystems and password databases as sensitive material.
• Rotate wireless pre-shared keys and potentially exposed administrative credentials.
• Check whether one credential is shared across multiple cameras.

Because CVE-2026-81321 may reveal a network key, credential rotation should cover the wireless infrastructure rather than only the affected device.

Exploitation status remains unclear

The CISA advisory for the CareCam CM2507 vulnerabilities does not identify public exploitation activity. It also does not state that any of the seven CVEs have been added to CISA’s Known Exploited Vulnerabilities catalog, so no KEV inclusion date or federal remediation deadline is known.

Organizations should not treat the absence of disclosed exploitation as evidence that exposed cameras are safe. Two flaws require only network access and no credentials, while the physical and credential-storage weaknesses provide several routes to deeper compromise once an attacker reaches the device.