What is CVE-2026-85497?

CVE-2026-85497 is a critical-severity vulnerability in Carecam Hmt.cm2507 Firmware, classified under Use of Password Hash With Insufficient Computational Effort. CVSS score: 9.8/10. Published 2026-09-18.

How severe is CVE-2026-85497?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Carecam Hmt.cm2507 Firmware

CVE-2026-85497

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Carecam Hmt.cm2507 Firmware — versions v251211.1507

Weakness classification (CWE)

CWE-916 — Use of Password Hash With Insufficient Computational Effort

References

Frequently asked questions

What is CVE-2026-85497?: CVE-2026-85497 is a critical-severity vulnerability in Carecam Hmt.cm2507 Firmware, classified under Use of Password Hash With Insufficient Computational Effort. CVSS score: 9.8/10. Published 2026-09-18.
How severe is CVE-2026-85497?: Critical severity. CVSS v3 base score is 9.8 out of 10.