Device Rebinding Vulnerability in EseeCloud Platform by CISA
CVE-2026-97858

6.9MEDIUM

Key Information:

Vendor

Guangzhou Juan Iot Technology Co., Ltd.

Status
Eseecloud App
Eseecloud Firmware
Vendor
CVE Published:
16 October 2026

What is CVE-2026-97858?

An attacker can exploit a vulnerability in EseeCloud that allows them to unbind a target device from its current owner and rebind it to their own account. This unauthorized action, which can occur regardless of the device's current ownership status, enables the attacker to gain access to sensitive information including the device's full serial ID. This poses significant risks to data security and device management within the platform.

Affected Version(s)

EseeCloud App 0 <= 4.9.6

EseeCloud Firmware 0 <= 4.9.86.0

References

https://eseecloud.app/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Donghyeon Lee of Tokyo University of Science and GMO Flatt Security reported this vulnerability to CISA.
.