CISA Advises: Three Critical Vulnerabilities in Guangzhou Juan IoT Technology EseeCloud

The Cybersecurity and Infrastructure Security Agency (CISA) has published advisory ICSA-26-288-02 detailing three security vulnerabilities in Guangzhou Juan IoT Technology EseeCloud software. The affected products are EseeCloud App (versions 4.9.6 and earlier) and EseeCloud Firmware (versions 4.9.86.0 and earlier).

The most severe flaw, CVE-2026-107617, carries a CVSS v3.1 base score of 9.8 (CRITICAL). It involves the use of hard-coded credentials, allowing an attacker to log in to EseeCloud devices without authentication. The second vulnerability, CVE-2026-97858, has CVSS scores of 5.3 (v3.1) and 6.9 (v4.0), both rated MEDIUM. It permits an attacker to unbind a target device from its current owner and rebind it to a requesting account, regardless of the device's current binding status, potentially exposing the device's full serial ID.

The third flaw, CVE-2026-105664, also rates 5.3 (v3.1) and 6.9 (v4.0) and is classified MEDIUM. It exploits an observable response discrepancy when processing ID values. A request with a nonexistent ID returns a different error code than one with a valid, registered ID. Combined with insufficient rate limiting, this creates an enumeration oracle that enables attackers to discover registered devices at scale.

The advisory notes that Guangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact the vendor for support at https://eseecloud.app/. The vulnerabilities span critical infrastructure sectors, including Energy, Communications, Transportation Systems, Financial Services, Government Services and Facilities, with equipment deployed worldwide.