CVE-2026-84398

HighCVSS 7.5/10Last modified Sep 19, 2026

Description

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-258

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Sep 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-843998.8The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does CVE-2026-844003.1CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An CVE-2026-844036.2The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low En CVE-2026-844088.7QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC whe CVE-2026-844097.5The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metada CVE-2026-84417.5The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX CVE-2026-844119.8The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable b CVE-2026-8441210.0Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in CVE-2026-844147.8IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validatio CVE-2026-844187.4IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connec CVE-2026-844196.8Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.20 CR, bef CVE-2026-84428.1The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due t