CVE-2026-97858: Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published Oct 16, 2026
·Updated
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.
Affected Software
1 affected component
Guangzhou Juan IoT Technology EseeCloud
Event History
Oct 16, 2026
CVE Published
via MITRE·02:04 PM
Data Sourced
via MITRE·02:04 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The issue is rated network-accessible with low attack complexity and requires no privileges or user interaction. An unauthenticated remote attacker can submit a request that rebinds a target device to the attacker's account.
2
What is the practical impact if exploitation succeeds?
The target device can be unbound from its current owner and bound to the requesting account even when it is already associated with another account. The attacker can then obtain the device's full serial ID.