A security camera gets bought once and then forgotten. It watches a gate, a yard or a store room. It is commissioned by whoever installed the alarm system, and nobody opens its settings again for years.
That habit is the subject of an advisory published on 15 September 2026 by CISA, the United States cyber security agency, setting out seven separate weaknesses in one widely sold model of network camera. The blunt one first: the live video service asks for no password. Anyone who can reach the camera across a network can watch what it watches.
There is no fix to apply. The manufacturer has not responded to the agency's attempts to coordinate, the advisory lists no corrected firmware and no vendor workaround, and the only remedy it records is that owners approach the company themselves.
This is not a plant control device. It is the camera on the gate, in the store room, above the weighbridge, more often specified by a security contractor than by an engineering team. The advisory files the class under commercial facilities and records deployment worldwide.
Anyone who cannot say which cameras their site runs, or who chose them, has a reason to find out. So does whoever holds that contract.
What the camera becomes
Two of the seven matter more than the rest, and neither is about video. The camera keeps the wireless network it joined in plain text on its own storage: both the network name and the pre-shared key, the password that gets a device onto that network. It also protects the password for its most privileged internal account with an ageing scrambling method, the sort a modern machine works backwards at speed, and the advisory notes the recovered credential may open other cameras running the same firmware.
Read those two together and the device stops being a video feed. It is the wireless key to the network it sits on, a password that may repeat across every identical unit on site, and a management channel, the one recording software uses to configure cameras, that opens to a privileged account with nothing typed in the password box and then gives up the device's configuration.
Three of the remaining issues need hands on the device: a script run automatically off removable media with no check on where it came from, a physical debug connector that hands over the camera's start-up software without asking who is connecting, and a maintenance mechanism that can be coaxed into opening a debugging service to the local network. Physical access sounds like a high bar until you remember where cameras live. A pole in a yard. A bracket on a fence line. A column in a contractor car park. Whoever can reach the lens can reach the connector behind it.
The cost here is not the camera. It is the work the camera creates. Someone has to walk the site and list every unit of that make, because no inventory holds it. The wireless key has to be rotated, which touches every device that shares it, including handhelds and sensors nobody was thinking about. A contractor gets called back for a job that was not costed this quarter. Where the cameras share a wireless network with anything operational, that list runs longer than the security manager expects and the conversation moves to engineering.
The questions to put
The first one is not about security at all. It is whether anybody on site can produce a list of the cameras, with makes and firmware, without walking out to look at them. On most sites the honest answer is no, and that answer is itself the finding.
The second belongs to the integrator who holds the maintenance record: whether these cameras sit on a network of their own, and whether the wireless key loaded into them is used anywhere else. Nothing exists to install here, so what the camera can reach, and what its stored credentials unlock, is the whole of the exposure.
The third is a procurement question rather than an engineering one. A manufacturer that does not return a national agency's calls is unlikely to return one raised from a mine gate, and the reasonable reading is that the next advisory against this product reads much like this one.
Most advisories end with a version to chase and a maintenance window to book. This one ends with a call that was not returned. That turns a patching task into a purchasing decision, and the answer an owner lands on is either a camera sitting somewhere it can do no harm, or a camera from a supplier who picks up.
The technical record
CISA ICS advisory ICSA-26-258-08, initial publication 15 September 2026.
Affected: CareCam CM2507, firmware HMT.CM2507 v251211.1507. Seven identifiers, with CVSS v3.1 and v4.0 base scores: CVE-2026-88259, missing authentication on the video streaming service, 7.5 and 8.7; CVE-2026-84398, empty password on a privileged ONVIF account, 7.5 and 8.7; CVE-2026-85497, weak root password hash, 7.5 and 9.3; CVE-2026-81321, cleartext wireless credentials, 7.5 and 9.3; CVE-2026-81305, unverified script execution from removable media, 6.8 and 7.0; CVE-2026-85478, unauthenticated bootloader on a physical debug interface, 3.5 and 2.4; CVE-2026-84400, activation of a remote debugging service from the local network, 3.1 and 2.3. The advisory's summary table carries a single CVSS v3 figure of 7.5. Weakness classes cited: missing authentication for a critical function, an empty password held in a configuration file, functionality included from an untrusted control sphere, a password hash with insufficient computational effort, and cleartext storage of sensitive information.
Attack position: three issues are reachable across the network, one from the same local network, and three require physical access to the unit.
Remediation: none published. CareCam has not responded to CISA's coordination attempts, and the advisory directs users to the vendor for further information.
Deployment: commercial facilities sector, worldwide, vendor headquartered in China.
The advisory closes with the agency's standing guidance on network exposure and remote access, and records no reports of exploitation reaching it.
Source
- cisa.gov/news-events/ics-advisories/icsa-26-258-08