CareCam CM2507: Seven CVEs, Live Video With No Login, And a Vendor Who Won't Pick Up

What this advisory is//

CISA published ICSA-26-258-08 on September 15, 2026 — another CareCam alert landing right on top of yesterday's CareCam Pro story, but a different camera and a different advisory. This one covers the CareCam CM2507, firmware v251211.1507 (the exact string: HMT.CM2507). If you own the "Pro" / ANJIA AJL33PC0801 from yesterday's post, that was ICSA-26-251-01 and a physical-access bootloader flaw. This is the CM2507, seven new CVEs, and a materially worse exposure class: remote.

The headline: live video with no login//

CVE-2026-88259 (CVSS 3.1 7.5, AV:N — network reachable, no credentials): the CM2507's network video streaming service does not require authentication. An unauthenticated attacker with network access to the camera simply retrieves live camera video. Not a stale JPEG endpoint that security researchers shrug at — the actual stream. The camera that was supposed to be watching your front door is now watchable by anyone on the path to it, and you wouldn't know.

The other six CVEs in the advisory:

CVE	What it is	CVSS v3.1
CVE-2026-88259	No auth for live video streaming (CWE-306)	7.5
CVE-2026-84398	Empty password accepted on a privileged ONVIF account — full device/user/media/stream config (CWE-258)	7.5
CVE-2026-81305	Auto-executes a script from removable media with no authenticity check → arbitrary code, physical access (CWE-829)	6.8
CVE-2026-85478	Interactive bootloader exposed on the physical debug interface, unauthenticated (CWE-306)	3.5
CVE-2026-85497	Root password stored with a fixed legacy hash — weak offline cracking, and possibly reusable across other devices running the same firmware (CWE-916)	7.5
CVE-2026-81321	Wi-Fi network credentials stored in cleartext on the filesystem (CWE-312)	7.5
CVE-2026-84400	Remote debugging service can be activated by an insufficiently protected maintenance mechanism (CWE-306)	3.1

Two of those deserve a second read because they're nastier than their scores suggest:

• CVE-2026-85497 — the root credential is hashed with "a fixed legacy password hash that provides insufficient resistance to offline cracking." Fixed means every unit has the same preimage. Crack it once from a firmware image and you may have the admin login for every CM2507 running v251211.1507 on the planet.
• CVE-2026-84398 — an empty password authenticates a privileged ONVIF account. So even if someone "changed" the camera's admin password, the management service may be wide open to whoever knows to ask ONVIF instead of the web UI.

Per CISA's summary, successful exploitation across the set "could allow an attacker to access live video and sensitive device information, enable unauthorized services, execute arbitrary code, modify device operation, and recover stored credentials." China HQ, Commercial Facilities sector, deployed worldwide, no known public exploitation yet — and not in KEV.

The fix: email CareCam//

The advisory's mitigation text is the whole remediation section, verbatim: "CareCam has not responded to CISA's attempts to coordinate. Users are encouraged to reach out to CareCam for more information." We ran that hook 24 hours ago on the Pro model — and it applies again here, but the practical difference is what it costs you. Yesterday's flaw needed someone next to the camera; this one needs only a network path. So when there's no patch pipeline, the control has to come from your side of the wall: segmentation.

What to do about it//

1. Inventory for CM2507 units (and any rebranded variants) and check the firmware string — v251211.1507 is the affected build per the advisory.
2. Segment them: dedicated camera VLAN, NVR-only ingress on RTSP 554, no egress to WAN or LAN — the full rule set is in this week's tutorial.
3. Reach out to CareCam yourself, per the advisory's own mitigation line — if a patch ever exists, you want to know it does.
4. Treat the admin credential as potentially shared (CVE-2026-85497): if you can swap these for cameras from a vendor that answers its email, consider it cheap insurance; otherwise assume anyone who ever had filesystem access — or a firmware image — could log in as root.
5. Watch ICSA-26-258-08 for an Update A — dead-vendor advisories usually get a revision when (if) the vendor finally responds.