Auth bypass in Carecam Hmt.cm2507 Firmware

CVE-2026-88259

CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.

Vulnerability class: Broken Authentication

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-88259?
CVE-2026-88259 is a high-severity vulnerability in Carecam Hmt.cm2507 Firmware, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2026-09-18.
How severe is CVE-2026-88259?
High severity. CVSS v3 base score is 7.5 out of 10.