What’s Vulnerable › Vulnerabilities

CVE-2026-97858: Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-16 · updated 2026-10-16
• Weakness: CWE-915

Description

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

Affected products

• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App: through 4.9.6
• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware: through 4.9.86.0

References

• https://eseecloud.app/
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02

Get alerted when CVE-2026-97858 or the next vulnerability affects your stack