CVE-2026-97858: Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App

Описание

Оригинално описание

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

Засегнати продукти

• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App: до 4.9.6
• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware: до 4.9.86.0

Вид слабост

• CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

История

Други уязвимости в Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App

• 6.9CVE-2026-105664
• 9.8CVE-2026-107617

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-97858
• https://nvd.nist.gov/vuln/detail/CVE-2026-97858
• https://eseecloud.app/
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json