EseeCloud Static Credentials Flaw Lets Attackers Log In Without Authentication on Older Versions
Attackers can log into EseeCloud devices using static credentials, bypassing authentication entirely on affected firmware and app versions.
Key points
- The flaw allows unauthorized login via hard-coded credentials.
- EseeCloud App versions up to 4.9.6 are affected.
- EseeCloud Firmware versions up to 4.9.86.0 are affected.
An attacker gains access to EseeCloud devices by exploiting a critical authentication bypass. This vulnerability stems from hard-coded credentials embedded within the software, allowing unauthorized users to log in. The flaw affects both the mobile application and the device firmware, creating a significant security gap for managed service providers overseeing IoT infrastructure.
How it unfolded
- The vulnerability was assigned CVE-2026-107617 by the National Vulnerability Database.
- Researchers identified that the flaw relies on CWE-798, use of hard-coded credentials.
- The issue was found in EseeCloud App versions up to 4.9.6 and Firmware up to 4.9.86.0.
Who is affected
Guangzhou Juan IoT Technology Co., Ltd. produces the EseeCloud platform. The vulnerability impacts devices running Firmware versions up to 4.9.86.0. Users of the EseeCloud App running versions up to 4.9.6 are also exposed. The flaw is rated as critical with a CVSS score of 9.8. This high severity rating reflects the critical nature of the authentication bypass.
The fix
No patch or update has been confirmed yet. Users of EseeCloud devices should monitor official channels from Guangzhou Juan IoT Technology Co., Ltd. for security advisories. Until a fix is released, the risk of unauthorized access remains high for all affected versions. Organizations should treat this as an active threat to their IoT security posture.
What made it possible
Hard-coded credentials represent a fundamental failure in secure development practices. Instead of generating unique keys or passwords for each device instance, developers embed static values directly into the codebase. This approach simplifies initial testing but creates a universal backdoor. Attackers can extract these values from the binary or configuration files. Once obtained, the credentials work on every affected device.
This flaw typically serves as the initial access vector in an intrusion chain. It allows adversaries to bypass standard authentication controls entirely. Teams usually mitigate this by enforcing strict code review processes. They also implement automated scanning to detect static secrets in repositories. Regular audits of third-party components help identify similar weaknesses before deployment.
What to do and how to stay safe: EseeCloud
- Inventory all EseeCloud devices to identify those running affected firmware or app versions.
- Isolate critical devices from the network to limit potential exposure until a fix is available.
- Monitor vendor communications for official patches or mitigation guidance.
- Review access logs for unusual login activity that may indicate exploitation.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-107617?
The CVSS score is 9.8, which is rated as critical.
Which EseeCloud App versions are vulnerable?
EseeCloud App versions up to 4.9.6 are affected by this vulnerability.
Who manufactures the affected EseeCloud devices?
Guangzhou Juan IoT Technology Co., Ltd. manufactures the affected devices.
