Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-85478

CareCam CM2507 Missing Authentication for Critical Function

CVSS 3.1 3.5 LOWCVSS 4.0 2.4 LOWCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-85478

Published

A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-85478

Published

HMT.CM2507 Firmware

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "CareCam",
                    "product": "HMT.CM2507 Firmware",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "v251211.1507"
                        }
                    ],
                    "defaultStatus": "affected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON