EseeCloud Static Credentials Flaw Grants Critical Access to Affected Devices
A critical flaw in EseeCloud devices allows attackers to log in using static, hard-coded credentials found in the application and firmware.
Key points
- CVE-2026-107617 affects EseeCloud App versions up to 4.9.6 and Firmware up to 4.9.86.0.
- The vulnerability carries a CVSS score of 9.8, rated as critical by the National Vulnerability Database.
- Attackers can gain access to devices by exploiting these static, embedded login details.
The EseeCloud platform contains a critical security flaw that allows attackers to bypass authentication using hard-coded credentials embedded within the software. This issue affects both the mobile application and the device firmware produced by Guangzhou Juan IoT Technology Co., Ltd. The vulnerability is tracked as CVE-2026-107617 and has been assigned a maximum severity score.
Root cause
The core issue stems from the inclusion of static, hard-coded credentials within the EseeCloud software components. According to the National Vulnerability Database, these fixed login details are embedded directly into the code rather than being generated uniquely for each installation or user. This practice, classified under CWE-798, means that anyone with access to the application or firmware files can extract the same username and password used by the system.
Attack path
An attacker does not need to guess passwords or exploit complex logic errors to gain access. Instead, they can simply use the known, hard-coded credentials to log in to affected EseeCloud devices. This bypasses the standard authentication process entirely, granting the attacker the same level of access as an authorised user. The flaw exists in the way the software handles identity verification, relying on a single, unchangeable set of login details.
Affected versions
The vulnerability impacts specific versions of the EseeCloud ecosystem. The affected software releases include:
- EseeCloud App versions up to and including 4.9.6
- EseeCloud Firmware versions up to and including 4.9.86.0
Devices running these or earlier versions are susceptible to the authentication bypass described in the advisory.
Mitigation
No official patch or fix has been confirmed by the vendor yet. Users should assume that devices running the affected versions remain vulnerable. Security teams should monitor official channels from Guangzhou Juan IoT Technology Co., Ltd. for updates. Until a remediation is available, isolating affected devices from public networks may reduce the risk of unauthorised access.
Why it matters
Hard-coded credentials represent a fundamental design error in secure software development. When login details are embedded in code, they are identical across every installation, making them trivial for attackers to discover. This eliminates the need for brute-force attacks or social engineering. Security teams usually rely on unique, user-generated passwords to protect accounts. Static credentials undermine this model, allowing anyone with the software file to gain immediate access. Understanding this concept helps explain why such flaws are rated as critical.
Background: National Vulnerability Database
The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.
Read the full guide: National Vulnerability Database: Small Business Action Plan
What to do and how to stay safe: EseeCloud
- Identify all devices running EseeCloud App versions 4.9.6 or older and Firmware versions 4.9.86.0 or older.
- Isolate affected devices from untrusted networks to prevent unauthorised remote access until a fix is available.
- Monitor vendor communications for an official security update or patched version of the software.
- Review network logs for unusual login activity that may indicate exploitation of the static credentials.
Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE identifier for this EseeCloud vulnerability?
The vulnerability is tracked as CVE-2026-107617.
How severe is this authentication bypass flaw?
It has a CVSS score of 9.8, which is rated as critical.
Which specific software versions are affected?
EseeCloud App up to version 4.9.6 and Firmware up to version 4.9.86.0 are affected.
