CVE-2026-81305: high-severity vulnerability in CareCam HMT.CM2507 Firmware
CareCam CM2507 Inclusion of Functionality from Untrusted Control Sphere
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7epss 0.3%
CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical access to the device could supply a malicious script and execute arbitrary code in the security context of the affected device.
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
CareCam · HMT.CM2507 FirmwareRelated CVEs — CareCam HMT.CM2507 Firmware
In the same product, most dangerous first.
CVE-2026-88259HIGHCareCam CM2507 Missing Authentication for Critical FunctionEPSS 0.5%CVE-2026-84398HIGHCareCam CM2507 Empty Password in Configuration FileEPSS 0.4%CVE-2026-81321CRITICALCareCam CM2507 Cleartext Storage of Sensitive InformationEPSS 0.3%CVE-2026-85497CRITICALCareCam CM2507 Use of Password Hash With Insufficient Computational EffortEPSS 0.3%CVE-2026-85478LOWCareCam CM2507 Missing Authentication for Critical FunctionEPSS 0.2%CVE-2026-84400LOWCareCam CM2507 Missing Authentication for Critical FunctionEPSS 0.2%