CVE-2026-88259

CareCam CM2507 Missing Authentication for Critical Function

State: Published
Severity: 8.7 High
Published: Sep 18, 2026
Updated: Sep 21, 2026
Reserved: Sep 10, 2026

Description

CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	icscert
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	icscert

Weaknesses

CWE-306

Affected Products

Product	Versions
HMT.CM2507 FirmwareCareCam	v251211.1507Affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-08
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-08.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.