Observable Response Discrepancy in EseeCloud Application Exposed by Vendor
CVE-2026-105664

6.9MEDIUM

Key Information:

Vendor

Guangzhou Juan Iot Technology Co., Ltd.

Status
Eseecloud App
Eseecloud Firmware
Vendor
CVE Published:
16 October 2026

What is CVE-2026-105664?

An observable response discrepancy has been identified in the EseeCloud application, allowing an attacker with a valid access token to exploit the endpoint handling ID values. When a request is made with an invalid ID, it generates a unique error response differing from that of a valid ID. This inconsistency enables attackers to glean insights into which ID values correspond to registered devices within the application. Furthermore, the lack of effective rate limiting on this endpoint exacerbates the problem, positioning it as an enumeration oracle that can be exploited to target registered devices at scale.

Affected Version(s)

EseeCloud App 0 <= 4.9.6

EseeCloud Firmware 0 <= 4.9.86.0

References

https://eseecloud.app/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Donghyeon Lee of Tokyo University of Science and GMO Flatt Security reported this vulnerability to CISA.
.