CISA notes that CareCam has not responded to coordination attempts. Users are encouraged to contact CareCam for mitigation information. No official patch has been confirmed available. Recommended actions include isolating affected devices from untrusted networks where possible, monitoring for unusual device behavior, and applying additional network-level access controls until a firmware update or official guidance is released.
Quick answers
What is CVE-2026-85478?
CISA notes that CareCam has not responded to coordination attempts. Users are encouraged to contact CareCam for mitigation information. No official patch has been confirmed available. Recommended actions include isolating affected devices from untrusted networks where possible, monitoring for unusual device behavior, and applying additional network-level access controls until a firmware update or official guidance is released.
How severe is CVE-2026-85478?
high, CVSS 8.7
Is CVE-2026-85478 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-85478 be mitigated?
CISA notes that CareCam has not responded to coordination attempts. Users are encouraged to contact CareCam for mitigation information. No official patch has been confirmed available. Recommended actions include isolating affected devices from untrusted networks where possible, monitoring for unusual device behavior, and applying additional network-level access controls until a firmware update or official guidance is released.
CVSS
8.7
Vendor
CareCam
Published
Sep 30, 2026 · 08:05
Patch
Unknown / not confirmed
Affected products
CareCam CM2507
Mitigation
CISA notes that CareCam has not responded to coordination attempts. Users are encouraged to contact CareCam for mitigation information. No official patch has been confirmed available. Recommended actions include isolating affected devices from untrusted networks where possible, monitoring for unusual device behavior, and applying additional network-level access controls until a firmware update or official guidance is released.
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued advisory ICS-26-258-08 disclosing seven vulnerabilities in the CareCam CM2507 IP camera firmware v251211.1507. The flaws span multiple severity levels, with CVSS scores from 2.3 to 8.7, and include critical issues such as missing authentication for network video streaming, acceptance of empty passwords for privileged accounts, and arbitrary code execution via removable media. CareCam has not responded to CISA's coordination attempts, and no official patch has been confirmed available as of the advisory date.