Threat database

CVE-2026-105664 is a medium severity vulnerability in the EseeCloud App by Guangzhou Juan IoT Technology Co., Ltd. The app's endpoint reveals different error responses when queried with valid versus nonexistent 10-digit ID values. This behavior allows an attacker with a valid access token but no further authentication to enumerate registered device IDs at scale due to the lack of effective rate limiting.

CVE-2026-97858 is a vulnerability in the EseeCloud App by Guangzhou Juan IoT Technology Co., Ltd. It allows an attacker to cause the server to unbind a target device from its current owner and rebind it to the attacker's account. This occurs regardless of whether the device is currently bound to a different account, enabling the attacker to obtain the device's full serial ID. The vulnerability is classified under CWE-915, indicating improperly controlled modification of dynamically-determined object attributes. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. No patch or remediation information is provided in the available data.

CVE-2026-107617 is a critical vulnerability in the Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App involving the use of hard-coded credentials. This flaw allows an attacker to log in to EseeCloud devices without authorization by leveraging these embedded credentials. The vulnerability affects versions from 0 up to and including 4.9.6 and 4.9.86.0. It has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. There is no information about available patches or vendor advisories addressing this issue.