- CISA listed three flaws in EseeCloud IP cameras and says the maker did not respond to its coordination attempts.
- The advisory names no fixed version, so owners cannot count on a quick patch and should plan for that risk.
- Find these cameras, take them off the internet, check their versions, and write supplier response duties into buying rules.
When the maker goes quiet, the risk moves to the buyer
A security advisory usually points to a fix. This one points to a vendor that has not answered CISA. CISA is the US cybersecurity agency. Its advisory of October 15 covers EseeCloud IP cameras. It says the maker, Guangzhou Juan IoT Technology, "did not respond to CISA's coordination attempts."
The lesson here is simple. A flaw is a shared problem only while the maker takes part in solving it. The advisory does not say the vendor ignores its customers. It does mean owners should plan for slow help, and own more of the risk themselves.
What CISA reports
CISA lists three vulnerabilities: CVE-2026-107617, CVE-2026-97858 and CVE-2026-105664. They affect the EseeCloud App up to version 4.9.6. They also affect EseeCloud firmware up to version 4.9.86.0. Firmware is the software built into the camera itself.
On impact, CISA warns that an attacker could take control of an affected camera.
Two outside parties reported the flaws to CISA: researcher Donghyeon Lee of Tokyo University of Science, and the firm GMO Flatt Security.
CISA also says it has no report of public attacks aimed at these flaws. That describes what CISA has been told. It does not prove that nobody is using them.
How the weaknesses work
CISA names three weakness types. It does not say which one belongs to which CVE ID. We describe each in general terms below. These are illustrations of the weakness types, not findings about how the EseeCloud cameras behave.
CWE-798 means hard-coded credentials. In general, a password is written into the product's code. Anyone who learns it may be able to use it.
CWE-915 covers a system that lets an outside request alter internal settings it should keep locked. Think of a guest changing the rules on a door they should only knock on.
CWE-204 is an observable response discrepancy. In general, the system answers differently depending on what an outsider sends. In products with this weakness, those differences can leak clues, for example whether an account exists.
CISA does not rank these three weaknesses or link them to specific attacks. Its only statement of impact is the risk of camera takeover.
The decision this forces
The advisory names no fixed version. It tells users to contact the vendor and lists the company's website. Because the advisory names no fix, we advise owners to plan as if none exists yet.
That changes the question. It is no longer "when do we update?" It becomes "do these cameras belong on our network at all?" That is a purchasing question as much as a technical one.
CISA's general advice fits this case. Keep control system devices off the internet. Put them behind firewalls, apart from business networks. Where remote access is needed, use a VPN, which is a private encrypted link. CISA adds that a VPN "is only as secure as the connected devices."
The advisory also tags the products with several sectors. They include energy, communications, transportation, financial services and government facilities. That does not mean any one organisation is exposed. It does show that cameras can sit inside sensitive sites.
Questions to put to your team
First, do we run EseeCloud cameras? Ask facilities and security teams to check, not just IT.
Second, can any of them be reached from the internet? If so, remove that access first.
Third, what version is each camera running? Anything at or below app 4.9.6 or firmware 4.9.86.0 is in scope.
Fourth, who has contacted the vendor, and what did it say? Keep a written record.
Fifth, what do our buying rules require of a supplier? Consider asking for a named security contact and a promise to respond to reported flaws.
A camera is a small computer watching your premises. When its maker does not answer CISA, treat that as a risk to plan for, not as a forecast of what the maker will do.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CISA.
