CISA Warns EseeCloud Camera Flaws Allow Device Takeover

Security flaws in the EseeCloud app and camera firmware could allow an attacker to take control of affected IP cameras, according to a CISA security advisory. Households using cameras managed through EseeCloud should check their versions now, isolate the devices and consider replacing them if the manufacturer cannot provide a fix.

What happened

CISA disclosed three vulnerabilities affecting software from Guangzhou Juan IoT Technology. The problems include hard-coded credentials and weaknesses involving how the software handles changes to certain data.

CISA gave the vulnerabilities a severity score of 9.8 out of 10 and said successful exploitation could give an attacker control over affected IP cameras. The advisory does not identify particular camera brands or model numbers, so owners may need to check whether a camera uses the EseeCloud app or firmware even if another brand name appears on the box.

CISA said Guangzhou Juan IoT Technology did not respond to attempts to coordinate the disclosure. The agency directed EseeCloud users to contact the company for support, but its advisory did not identify a patched app or firmware release.

Who is affected

The advisory lists these versions as affected:

• EseeCloud app version 4.9.6 and earlier
• EseeCloud firmware version 4.9.86.0 and earlier

People who use EseeCloud to view or manage an IP camera should check both the mobile app and the camera firmware. Updating only the phone app may not address a vulnerable firmware version inside the camera.

Affected camera models have not been disclosed. If your camera uses a different app, that alone does not prove it is safe; check its documentation or support page to learn whether it relies on EseeCloud technology.

What to do now

1. Check the EseeCloud app version. On Android, open Google Play, find EseeCloud and tap About this app. On an iPhone, find EseeCloud in the App Store and review its version information. Install any available update, but remember that CISA has not identified a fixed version.

2. Check each camera’s firmware. Open the EseeCloud app, select the camera and look in its device settings for firmware, version or update information. Menu names may vary. Firmware at or below 4.9.86.0 is listed as affected.

3. Move the camera off your main network. Place it on a guest or IoT Wi-Fi network so a compromised camera has less access to computers, phones and storage devices. CyberSec24’s smart-device guest Wi-Fi guide explains this separation.

4. Disable unnecessary outside access. In your router settings, remove any port-forwarding rule aimed at the camera and turn off remote management you do not use. Consider disabling UPnP, which can let devices request network openings automatically; see our guide to router settings worth disabling.

5. Contact the camera seller and EseeCloud support. Ask whether your exact model has fixed firmware. If no supported update is available, disconnect and replace the camera rather than leaving a takeover risk on your network.