CVE-2026-85478 describes a security weakness in the CareCam HMT.CM2507 IP camera firmware version 251211.1507. The device exposes an interactive bootloader accessible through a physical debug interface that does not require authentication. An attacker with physical access can interrupt the normal boot process to access bootloader functionality, enabling inspection or modification of boot configuration, firmware data, and software loaded by the device. This vulnerability corresponds to CWE-306, indicating missing authentication for a critical function.

An attacker with physical access to the device can exploit this vulnerability to gain unauthorized access to the bootloader interface. This may allow inspection or modification of sensitive boot configuration and firmware data, potentially undermining device integrity and security. However, the vulnerability requires physical access and does not allow remote exploitation. The CVSS score of 3.5 reflects limited impact and attack vector.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict physical access to the device to prevent exploitation of the unauthenticated bootloader interface.