Hmt.Cm2507 Firmware
Approved changes feed: RSS · Atom
cpe:2.3:a:carecam:hmt.cm2507_firmware:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Carecam (3f04c1e3-e3d2-5fe3-9ffa-bb4722b9ae72) |
|---|---|
| Product | Hmt.Cm2507 Firmware (7b75caf1-0605-5fac-a854-7a0205064a79) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-88259 |
vulnerable | 2026-10-13 12:29:54.807957 |
CareCam CM2507 Missing Authentication for Critical Function
HIGH (7.5)
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.
Published: 2026-09-18T16:05:06.400Z
Updated: 2026-09-21T18:14:07.279Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84398 |
vulnerable | 2026-10-13 12:28:55.570964 |
CareCam CM2507 Empty Password in Configuration File
HIGH (7.5)
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information.
Published: 2026-09-18T16:07:53.521Z
Updated: 2026-09-19T14:11:44.013Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84400 |
vulnerable | 2026-10-13 12:28:55.486273 |
CareCam CM2507 Missing Authentication for Critical Function
LOW (3.1)
CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions could make the service remotely accessible, increasing the risk of unauthorized administrative access.
Published: 2026-09-18T16:10:28.768Z
Updated: 2026-09-19T14:11:43.861Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-85478 |
vulnerable | 2026-10-13 12:28:54.159352 |
CareCam CM2507 Missing Authentication for Critical Function
LOW (3.5)
A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.
Published: 2026-09-18T16:16:20.994Z
Updated: 2026-09-21T18:45:56.301Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-85497 |
vulnerable | 2026-10-13 12:28:53.902428 |
CareCam CM2507 Use of Password Hash With Insufficient Computational Effort
CRITICAL (9.8)
CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.
Published: 2026-09-18T16:19:23.396Z
Updated: 2026-09-21T18:46:26.392Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-81305 |
vulnerable | 2026-10-13 12:28:37.049789 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-81321 |
vulnerable | 2026-10-13 12:28:36.962044 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.