CVE-2026-97858
Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 16, 2026
- Updated
- Oct 16, 2026
- Reserved
- Oct 12, 2026
Description
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | icscert |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | icscert |
Weaknesses
- CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected Products
| Product | Versions |
|---|---|
EseeCloud AppGuangzhou Juan IoT Technology Co., Ltd. |
|
EseeCloud FirmwareGuangzhou Juan IoT Technology Co., Ltd. |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.