CVE-2026-97858: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App

This vulnerability (CVE-2026-97858) in the EseeCloud App allows an unauthenticated attacker to manipulate the server's device binding logic. By exploiting improper control over dynamically-determined object attributes (CWE-915), the attacker can force the server to unbind a device from its legitimate owner and rebind it to the attacker's account. This process also exposes the device's full serial ID to the attacker. The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact.

An attacker can take control of a device by unbinding it from its legitimate owner and rebinding it to an attacker-controlled account. This compromises device ownership integrity and confidentiality of the device's serial ID. There is no impact on integrity or availability according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should monitor vendor communications for updates. No vendor advisory states that no action is required or that the issue is already mitigated.