CVE-2026-85478: low-severity vulnerability in CareCam HMT.CM2507 Firmware
CareCam CM2507 Missing Authentication for Critical Function
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.4epss 0.2%
A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
CareCam · HMT.CM2507 FirmwareRelated CVEs — CareCam HMT.CM2507 Firmware
In the same product, most dangerous first.
CVE-2026-88259HIGHCareCam CM2507 Missing Authentication for Critical FunctionEPSS 0.5%CVE-2026-84398HIGHCareCam CM2507 Empty Password in Configuration FileEPSS 0.4%CVE-2026-81321CRITICALCareCam CM2507 Cleartext Storage of Sensitive InformationEPSS 0.3%CVE-2026-85497CRITICALCareCam CM2507 Use of Password Hash With Insufficient Computational EffortEPSS 0.3%CVE-2026-81305HIGHCareCam CM2507 Inclusion of Functionality from Untrusted Control SphereEPSS 0.3%CVE-2026-84400LOWCareCam CM2507 Missing Authentication for Critical FunctionEPSS 0.2%