Multiple Critical Vulnerabilities Affect CareCam CM2507 IP Cameras

The US Cybersecurity and Infrastructure Security Agency (CISA) has published advisory ICS-26-258-08 detailing seven vulnerabilities affecting CareCam CM2507 IP camera firmware version v251211.1507. The vulnerabilities were assigned CVE identifiers CVE-2026-88259, CVE-2026-84398, CVE-2026-84400, CVE-2026-81305, CVE-2026-85478, CVE-2026-85497, and CVE-2026-81321.

CVE-2026-88259 is rated HIGH with a CVSS v3.1 score of 7.5. It involves missing authentication for the network video streaming service, allowing an unauthenticated attacker with network access to retrieve live camera video.

CVE-2026-84398, also HIGH at CVSS 8.7 (v4.0), allows an attacker with network access to exploit an empty password for a privileged account exposed through the ONVIF management service, potentially gaining access to privileged management functions and device, user, media-profile, and stream configuration information.

CVE-2026-84400 is rated LOW with CVSS v3.1 score 3.1 and v4.0 score 2.3. It concerns an insufficiently protected network maintenance mechanism that can activate a remote debugging service, potentially making it remotely accessible to an attacker on the same local network who satisfies certain device state conditions.

CVE-2026-81305 is rated HIGH with CVSS v3.1 score 6.8 and v4.0 score 7.0. This vulnerability allows an attacker with physical access to the device to supply a malicious script on removable media that the camera will automatically execute without verifying authenticity or integrity, running in the security context of the affected device.

The advisory also lists CVE-2026-85478, CVE-2026-85497, and CVE-2026-81321, though detailed descriptions for these three CVEs were not fully included in the provided source material.

CareCam, headquartered in China, has not responded to CISA's attempts to coordinate on remediation. Users are encouraged to reach out to CareCam for mitigation information. The advisory notes that no confirmed active exploitation has been reported, but the described attack vectors -- including unauthenticated video access and empty password privilege escalation -- present significant risk, particularly in commercial facility environments where these devices are deployed worldwide.