What’s Vulnerable › Vulnerabilities

CVE-2026-88259: CareCam CM2507 Missing Authentication for Critical Function

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-09-21
• Weakness: CWE-306

Description

CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.

Affected products

• CareCam HMT.CM2507 Firmware: v251211.1507

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-08.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-08

Get alerted when CVE-2026-88259 or the next vulnerability affects your stack