What is CVE-2026-85478?

CVE-2026-85478 is a low-severity vulnerability in Carecam Hmt.cm2507 Firmware, classified under Missing Authentication for Critical Function. CVSS score: 3.5/10. Published 2026-09-18.

How severe is CVE-2026-85478?

Low severity. CVSS v3 base score is 3.5 out of 10.

Auth bypass in Carecam Hmt.cm2507 Firmware

CVE-2026-85478

A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.

Vulnerability class: Broken Authentication

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Carecam Hmt.cm2507 Firmware — versions v251211.1507

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

Frequently asked questions

What is CVE-2026-85478?: CVE-2026-85478 is a low-severity vulnerability in Carecam Hmt.cm2507 Firmware, classified under Missing Authentication for Critical Function. CVSS score: 3.5/10. Published 2026-09-18.
How severe is CVE-2026-85478?: Low severity. CVSS v3 base score is 3.5 out of 10.