Our takeCISA reports active exploitation in Guangzhou Juan IoT Technology's EseeCloud: three flaws (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664) let attackers take control of affected IP cameras on app <=4.9.6 and firmware <=4.9.86.0. Patch immediately if you run these devices.Security Resilience desk
Sources (2)
- cisa_ics · cisa_ics
- cisa_advisories · cisa_advisories
What this means for you — Security leader:CISA reports active exploitation of three vulnerabilities in Guangzhou Juan IoT Technology EseeCloud (app ≤4.9.6 and firmware ≤4.9.86.0) that let remote attackers take control of affected IP cameras. Update immediately or isolate the devices if you run them.
What this means for you — Lean IT orgs:If you use EseeCloud IP cameras or the associated app, update the firmware and app right away or disconnect them from the internet until you can.
What this means for you — MSP:Check client environments for any EseeCloud IP cameras or the EseeCloud app (≤4.9.6 / firmware ≤4.9.86.0). Patch or isolate immediately; this is under active exploitation per CISA.
What this means for you — Researcher:CISA advisory ICSA-26-288-02 details three actively exploited vulnerabilities in EseeCloud ≤4.9.6 (app) and ≤4.9.86.0 (firmware) allowing full control of affected IP cameras. Review the CSAF for technical details.