Eseecloud Firmware
Approved changes feed: RSS · Atom
cpe:2.3:a:guangzhou_juan_iot_technology_co.,_ltd.:eseecloud_firmware:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Guangzhou Juan Iot Technology Co., Ltd. (125a1d4f-1010-5a68-b8a2-7f2f11b21029) |
|---|---|
| Product | Eseecloud Firmware (bd4327ed-b608-54b4-b0ec-eb2300408337) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-105664 |
vulnerable | 2026-11-03 10:16:33.261904 |
Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy
MEDIUM (5.3)
The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization - to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale.
Published: 2026-10-16T14:06:55.903Z
Updated: 2026-10-16T15:20:19.651Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-107617 |
vulnerable | 2026-11-03 10:15:59.103260 |
Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials
CRITICAL (9.8)
An attacker can use a hard-coded credential to log in to EseeCloud devices.
Published: 2026-10-16T14:02:54.778Z
Updated: 2026-10-16T15:20:20.297Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-97858 |
vulnerable | 2026-11-03 10:15:26.283132 |
Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes
MEDIUM (5.3)
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.
Published: 2026-10-16T14:04:47.580Z
Updated: 2026-10-16T15:20:19.972Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.