CVE-2026-107617

{
  "etk_id": "ETK-2026-1780",
  "cve_id": "CVE-2026-107617",
  "display_id": "CVE-2026-107617",
  "ghsa_id": "GHSA-75pm-gcg3-4jf4",
  "euvd_id": "EUVD-2026-102878",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Hard-coded credentials in EseeCloud App",
  "summary": "EseeCloud App and EseeCloud Firmware contain an embedded credential that can affect authentication to EseeCloud devices. An unauthenticated remote attacker who knows the credential may be able to access affected devices without legitimate user credentials.",
  "mitigation": "Restrict EseeCloud device access to trusted hosts and networks, and isolate devices from untrusted internet exposure. Apply vendor updates when available; no fixed version is recorded for the app or firmware.",
  "vendor": "Guangzhou Juan IoT Technology Co., Ltd.",
  "product": "EseeCloud App",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.9.6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "EseeCloud App",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.9.86.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "EseeCloud Firmware",
      "purl": null
    }
  ],
  "cwes": [
    798
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0033,
  "epss_percentile": 0.2415,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.850444866666667,
  "t0_at": "2026-10-16T14:02:54.778000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-16T14:02:54.778000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T14:02:54.778000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107617"
    }
  }
}