CVE-2026-97858
Received Received - Intake

Unauthorized Device Reassignment in IoT Management System

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: ICS-CERT

Description
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-97858
EUVD
EUVD-2026-102879

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App 0
Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker to unbind a device from its current owner and rebind it to their own account without permission. The attacker can obtain the device's full serial ID even if it is already bound to another account.

Impact Analysis

An attacker could take control of your IoT device, access its data, or use it for malicious purposes. This may lead to privacy breaches, unauthorized access, or loss of device functionality.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA if it results in unauthorized access to personal or sensitive data. Organizations may face legal penalties or reputational damage.

Mitigation Strategies

Immediately restrict unauthorized account access to the EseeCloud system and review device ownership bindings. Monitor for suspicious rebinding attempts and disable remote unbinding functionality if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97858. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart