CVE-2026-85497

Summary

The CareCam CM2507 IP cameras use a fixed legacy password hash for the root account, making it susceptible to offline cracking. This flaw allows an attacker to recover the password, posing a significant security risk.

Exploitability

Exploiting this flaw is relatively straightforward for an attacker who has obtained the firmware image or password database, as the fixed hash provides no resistance to offline cracking.

Blast radius

If exploited, this flaw could lead to full device compromise, allowing an attacker to gain root access and potentially control the camera or other connected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected feature or upgrade to the latest firmware version, specifically 'Upgrade to the latest firmware version available from the vendor'.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.