CVE-2026-105664: CWE-204 in Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App

The vulnerability in EseeCloud App involves an endpoint that returns distinct error codes when processing ID values, allowing an attacker possessing a valid access token to differentiate between valid and nonexistent 10-digit numeric IDs. Because there is no meaningful rate limiting on this endpoint, the attacker can perform enumeration attacks at scale to discover registered devices. This is categorized as CWE-204 (Observable Discrepancy). The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker with a valid access token can enumerate registered devices by exploiting the observable response discrepancy in the ID processing endpoint. This leads to information disclosure of valid device IDs but does not affect data integrity or system availability. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for unusual access patterns and consider implementing custom rate limiting or anomaly detection on the affected endpoint to reduce enumeration risk.