Remote Access Vulnerability in CareCam CM2507 IP Cameras
CVE-2026-84400

2.3LOW

Key Information:

Vendor

Carecam

Status
Hmt.cm2507 Firmware
Vendor
CVE Published:
18 September 2026

What is CVE-2026-84400?

The CareCam CM2507 IP cameras feature a network maintenance mechanism that is inadequately secured, allowing for the activation of a remote debugging service. An attacker connected to the same local network, under specific device conditions, may gain unauthorized access to this service. This oversight poses a significant risk by potentially enabling unauthorized administrative control over the affected devices.

Affected Version(s)

HMT.CM2507 Firmware v251211.1507

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ben Law reported this vulnerability to CISA.
.