CVE-2026-88259: CareCam CM2507 Missing Authentication for Critical Function
Published Sep 18, 2026
·Updated
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.
Affected Software
1 affected component
CareCam CM2507 IP camera
Event History
Sep 18, 2026
CVE Published
via MITRE·04:05 PM
Data Sourced
via MITRE·04:05 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker be able to do to exploit this issue?
The attacker needs network access to the affected camera's video-streaming service. No privileges or user interaction are required.
2
What is the expected security impact?
The issue has high confidentiality impact because live video can be retrieved. The supplied CVSS vector indicates no integrity or availability impact.