CareCam CM2507

1. Executive summary

On 2026-09-15 CISA published ICSA-26-258-08 covering seven vulnerabilities in CareCam CM2507 IP cameras running firmware HMT.CM2507 v251211.1507, including unauthenticated access to the live network video streaming service, an empty privileged password on the ONVIF management service, and cleartext storage of the configured wireless PSK. CISA's published scores span CVSS v3.1 3.5 LOW to 7.5 HIGH and CVSS v4.0 2.3 LOW to 9.3 CRITICAL; the two highest-scoring issues (CVE-2026-85497, CVE-2026-81321) are credential-recovery flaws rated 9.3 CRITICAL under CVSS v4.0. CareCam has not responded to CISA's coordination attempts and no fixed firmware version exists — there is no vendor patch path for any of the seven issues. CISA reports no known public exploitation targeting these vulnerabilities, and no CISA KEV entry or EPSS score is available in our reference data for this item. For EMEA financial services the exposure is twofold: unauthenticated access to physical-security video, and recoverable credential material (device root password, Wi-Fi pre-shared key) that can bridge an isolated camera segment into corporate wireless.

2. Regulatory framing

DORA Art. 19 and NIS2 Art. 23 (incident reporting) are not engaged by this item: CISA states no public exploitation has been reported, so no incident has occurred. DORA Art. 17/18 are likewise not engaged absent an actual ICT-related incident.

3. Technical analysis & attack chain

Affected product: CareCam CM2507 IP camera, firmware HMT.CM2507 v251211.1507 (all seven CVEs). CISA lists deployment as worldwide, vendor headquarters in China, critical infrastructure sector Commercial Facilities. The advisory's summary table records the equipment at CVSS v3 7.5.

Triage table (ordered by CVSS v4.0 severity; no KEV or EPSS data is available in our reference data for any of these CVEs):

CVE-to-description mapping caveat: the related source is truncated mid-way through CVE-2026-85497 and does not show the description for the seventh CVE. The mapping of the cleartext-wireless-credential issue to CVE-2026-81321 is by position in the advisory's CVE list and should be treated as low-confidence until the full advisory text is read.

Confirmed attack chain. These are the exploitation paths CISA describes; CISA states no public exploitation has been reported, so none of the below has been observed in the wild.

1. Unauthenticated live video (CVE-2026-88259). The camera's network video streaming service requires no authentication. An attacker with network access to the device retrieves live camera video directly.
2. Empty privileged password on ONVIF (CVE-2026-84398). The CM2507 accepts an empty password for a privileged account exposed through the ONVIF management service. An attacker with network access authenticates to privileged management functions and obtains device, user, media-profile and stream configuration information.
3. Remote debugging service activation (CVE-2026-84400). An insufficiently protected network maintenance mechanism can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions can make that service remotely accessible, increasing the risk of unauthorised administrative access.
4. Removable-media script execution (CVE-2026-81305). The camera automatically executes a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical access supplies a malicious script and executes arbitrary code in the security context of the device.
5. Unauthenticated bootloader over the physical debug interface (CVE-2026-85478). On firmware HMT.CM2507 v251211.1507, an interactive bootloader is exposed through a physical debug interface without authentication. An attacker with physical access interrupts the normal boot process and reaches functionality permitting inspection or modification of boot configuration, firmware data, and software loaded by the device.
6. Root password hash recovery (CVE-2026-85497). The device stores the root-account password using a fixed legacy password hash with insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database recovers the associated credential, which may also be reusable across other devices running the same firmware.
7. Cleartext wireless credentials (CVE-2026-81321). The camera stores configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access — via physical access, a debugging interface, or another vulnerability — recovers the configured network identifier and pre-shared key.

Chaining (Adverse Trace assessment, not stated in the source). The advisory presents these as independent issues, but steps 3, 5, 6 and 7 compose into a full device-compromise path: same-LAN activation of the debugging service (3) or physical debug-interface access (5) yields filesystem access, from which the cleartext Wi-Fi PSK (7) and the crackable root hash (6) are recoverable. The PSK is the material risk to a financial-services estate, because it moves the attacker off the camera segment and onto the wireless network the camera is joined to. This chaining is our inference from the described flaws and has not been demonstrated in the source.

What the source does not describe. No malware, payload, command-and-control channel, persistence mechanism, lateral-movement tooling, exfiltration method or observed impact is described anywhere in this advisory. There are no file names, command lines, ports, registry keys or network indicators. Do not infer them.

Metrics discrepancy (flagged, not re-scored). For CVE-2026-85497 and CVE-2026-81321 the advisory publishes CVSS v3.1 vectors ending C:N/I:N/A:H (availability-only, 7.5 HIGH) while the CVSS v4.0 vectors for the same issues are VC:H/VI:H/VA:H (9.3 CRITICAL) and the descriptions are confidentiality flaws. The v3.1 vectors appear inconsistent with the described impact — both entries carry an identical vector string, suggesting a copy-paste in the source metrics. We reproduce the published values as-is and do not re-assess them.

4. Mitigation & containment

There is no vendor fix. CareCam has not responded to CISA's coordination attempts; CISA's only remediation guidance is for users to contact CareCam directly. All controls below are compensating controls.

P1 — within 24 hours

• Inventory. Identify every CareCam CM2507 on the estate and confirm firmware HMT.CM2507 v251211.1507. Treat unconfirmed devices as affected.
• Segment. Move all CM2507 cameras to a dedicated VLAN with deny-by-default inbound and outbound. Permit access to the network video streaming service and the ONVIF management service only from the specific VMS/NVR hosts that require it. Remove any port-forward, UPnP mapping or reverse proxy that exposes a camera to the internet.
• Credentials. Check the privileged ONVIF account for an empty password and set a strong, unique password where the interface permits. Do not treat this as a fix — the empty-password path may remain reachable regardless of the configured value.
• Wireless. For any CM2507 joined to a Wi-Fi network, treat the stored PSK as compromised and rotate it. Rotate the device root password and check whether the same root credential is reused across the camera fleet (CVE-2026-85497 explicitly warns of cross-device reuse).
• Physical. Restrict physical access to the devices; lock or seal enclosures; disable removable-media ports where the hardware permits; enable tamper monitoring. Physical access alone is sufficient for CVE-2026-81305 and CVE-2026-85478.

P2 — within 72 hours

• Detect. Alert on connections to the camera streaming or ONVIF management services from hosts other than the authorised VMS/NVR. Alert on new or unexpected listening services on camera hosts — this is the observable signature of remote debugging service activation (CVE-2026-84400).
• Egress. Block camera-VLAN egress to the internet except to explicitly required VMS or update endpoints.
• Disable what you can. If the remote debugging service can be disabled through device configuration, disable it. If it cannot, treat every device on the same Layer-2 segment as able to reach administrative functionality.

P3 — within 7 days

• Supplier risk. Escalate to CareCam in writing; document the no-fix status and the absence of a vendor response. Run this through the DORA Art. 28 third-party risk process: assess substitutability and begin evaluating replacement with a supported vendor.
• Compensating architecture. Apply 802.1X or NAC on camera switch ports, terminate camera traffic at a hardened VMS proxy, and require mutual authentication between camera and VMS where the platform supports it.
• CISA guidance. Apply the defence-in-depth practices in ICS-TIP-12-146-01B (Targeted Cyber Intrusion Detection and Mitigation Strategies) referenced in the advisory.

5. Indicators of compromise

No indicators of compromise available in the source material. The advisory contains no hashes, domains, IP addresses, URLs, file names, file paths, registry keys or command lines.

The source does describe observable behaviours without atomic indicators, so the following behavioural indicators are provided for detection engineering.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The only distinctive string in the source is the firmware version identifier HMT.CM2507 v251211.1507. That identifies the affected product, not the threat, so a rule keyed on it would detect the device rather than any malicious artefact. No file names, command lines, mutexes, scheduled-task names, service names, registry keys or ransom-note text are present in the source material.

7. Sources

• CISA, "CareCam CM2507", ICSA-26-258-08, published 2026-09-15 — https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-08

Single source. All technical detail, CVSS values and the no-vendor-response statement in this advisory derive from this one CISA publication; the related source supplied with this item is the same URL.

8. Adverse Trace position

Severity. No verified reference data was resolved for this item, so every CVSS value above is reproduced as published by CISA and is single-sourced. On those published values the item is HIGH under CVSS v3.1 (maximum 7.5) and CRITICAL under CVSS v4.0 (maximum 9.3, on CVE-2026-85497 and CVE-2026-81321). We note, without re-scoring, that the CVSS v3.1 vectors published for those two CVEs are availability-only and inconsistent with their described confidentiality impact — the v4.0 vectors and the descriptions both indicate a confidentiality flaw. There is no CISA KEV entry and no EPSS score in our reference data, and CISA reports no known public exploitation; we do not treat this as actively exploited.

Client impact. The network-reachable flaws (CVE-2026-88259, CVE-2026-84398) are trivially exploitable by anyone with reach to the camera segment and expose live video and device configuration. The more consequential risk for a financial-services estate is the credential material: a cleartext Wi-Fi PSK and a fleet-wide crackable root hash, both recoverable once an attacker has filesystem access through the debugging service or physical access. That is a path from a physical-security device onto the corporate wireless network, and it is the reason we rate this above a routine camera advisory despite the absence of observed exploitation. The absence of any vendor fix and any vendor response means compensating controls are the only available mitigation.

Next steps. We will monitor for a CareCam response, a fixed firmware release, and any CISA KEV addition or public exploitation reporting, and will re-issue if any of those appear. Clients running CM2507 on firmware HMT.CM2507 v251211.1507 should treat the P1 segmentation and credential-rotation actions as immediate, and should not wait for a vendor patch that may not arrive.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.