CVE-2026-100906
Received Received - Intake

Information Disclosure in Eyeplus ONVIF Device

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipulation results in information disclosure. The attack can be executed remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-100906
EUVD
EUVD-2026-88072

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
eyeplus ip_camera 57.0.0.0308
eyeplus tc155 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Eyeplus 57.0.0.0308 allows remote attackers to access the ONVIF GetUsers API without authentication. By sending a specific unauthenticated ONVIF request to the camera's IP address, an attacker can retrieve the administrator username and plaintext password via a SOAP response. This is classified as CWE-306 (Missing Authentication for Critical Function) and CWE-200 (Exposure of Sensitive Information).

Detection Guidance

To detect this vulnerability, check if unauthenticated ONVIF GetUsers API requests return sensitive information. Use tools like curl to send a SOAP request to the ONVIF endpoint. Example command: curl -X POST http://<camera_ip>/onvif/Device -H 'Content-Type: text/xml' -d '<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"><s:Body><GetUsers xmlns="http://www.onvif.org/ver10/device/wsdl"/></s:Body></s:Envelope>'

If the response includes administrator credentials in plaintext, the device is vulnerable. Monitor network traffic for unauthenticated ONVIF requests targeting /onvif/Device.

Impact Analysis

This vulnerability enables unauthorized access to the device, allowing attackers to obtain sensitive credentials in plaintext. This could lead to further compromise of the device, potential surveillance, or unauthorized control. Since the exploit is public, the risk of exploitation is higher.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access and exposure of sensitive information. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. The plaintext credential exposure violates these regulations.

Mitigation Strategies

Isolate the affected Eyeplus IP camera or TC155 device from untrusted networks. Disable ONVIF services if not required. Implement network segmentation to restrict access to the device. Monitor for unauthorized access attempts.

Contact the vendor for firmware updates or patches. If no patch is available, consider replacing the device with a more secure alternative.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100906. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart