Your $50 PoE Camera's Bootloader Has a Hard-Coded Password (CVE-2026-85083)

What this advisory is//

CISA published ICSA-26-251-01 on September 8, 2026 — an ICS (Industrial Control Systems) advisory about a product most of us don't think of as "industrial": the CareCam Pro IP camera, sold under the ANJIA brand as the AJL33PC0801. The affected firmware string is exact and specific: linux_linux_202008261138_svn13796/_Bootloader_U-Boot_2010.06_compiled_2020-08-26 — a 2020 build, which tells you how long this box has been out in the world with the same bootloader inside it.

The vulnerability is CVE-2026-85083, classified as CWE-798: Use of Hard-coded Credentials. CISA scores it CVSS 3.1 base 6.8 (AV:P — physical access required) and CVSS 4.0 base 7.0. The low-ish number is doing a lot of work here: it says "you have to be next to the camera," which sounds comforting until you remember that cameras live in doorways, garages, backyards, and open racks, places where physical access is a lot cheaper than people assume.

What actually broke//

The hard-coded credential authenticates the bootloader — specifically the U-Boot shell on these cameras. The chain, per the advisory:

1. An attacker with physical access to the device leverages the hard-coded credential.
2. They land in a privileged U-Boot shell.
3. From there they can modify firmware and system configuration.
4. Result: complete device compromise — "take full control of the device" is CISA's own summary line.

Why does the bootloader matter when you could just log into the web UI? Because the bootloader sits below everything else. A compromised U-Boot shell can rewrite the firmware image itself, which means a reset-to-factory won't save you — the "fresh" boot loads whatever the attacker left behind. On a camera that's watching your front door for Frigate, that's not an abstraction: it's a device that was supposed to be watching now potentially being watched.

Two facts from the advisory worth repeating because they frame everything else:

• Not remotely exploitable. No one is scanning Shodan for this specific bug; you need hands on the box.
• No known public exploitation has been reported to CISA at the time of publication. Reporter Omkar Mali disclosed direct-to-CISA — and that's the kicker, because CareCam has not responded to CISA's coordination attempts. The advisory literally tells users "reach out to CareCam" as the mitigation.

Why a dead vendor is the real story//

The vulnerability is only half of this one. The other half is the response process: when an ICS vendor doesn't answer, there's no patch pipeline, no firmware roadmap, and no one to call when you find something new in the same codebase. That converts a "medium" CVE into a permanent trust-boundary problem: the only mitigations left are segmentation (don't let the camera VLAN talk to your LAN VLAN) and physical custody (if someone can pick up the cam, assume they got root).

What to do about it//

1. Check your inventory for CareCam Pro / ANJIA AJL33PC0801 units (and any rebranded variants) — the firmware string above is how you confirm the build.
2. Segment them: dedicated camera VLAN, no direct LAN route, firewall rules that only allow what Frigate/NVR actually needs.
3. Treat physical custody as a security control — locked rack, camcage on exterior units, and "any recovered/stolen-returned unit gets reflashed or retired."
4. Reach out to CareCam yourself, per the advisory's own mitigation line — if a patch ever lands, you want to know it exists.
5. Watch for an Update A on ICSA-26-251-01 — dead-vendor advisories usually get a revision when (if) the vendor finally responds.