CVE-2026-85478: CareCam CM2507 Missing Authentication for Critical Function
A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Use physical security controls to restrict access to the camera’s physical debug interface (e.g., lock the device enclosure and restrict/monitor physical access) to prevent an attacker from interrupting boot and accessing unauthenticated bootloader/debug functionality.
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Devices that an attacker can physically access are exposed. Exploitation requires reaching the camera's physical debug interface and interrupting its normal boot process.
What can an attacker do after accessing the bootloader?
The bootloader functionality can permit inspection or modification of boot configuration, firmware data, and software loaded by the device.
Is remote exploitation indicated?
No. The available information describes access through a physical debug interface and does not indicate a network-reachable attack path.
How can I determine whether a device is affected?
Confirm that the device is a CareCam CM2507 and is running firmware HMT.CM2507 v251211.1507. The described condition concerns unauthenticated access to its interactive bootloader through the physical debug interface.