Security1 publisher2 min readPublished
Two of seven unpatched CareCam CM2507 camera flaws let anyone on the network view live video
CISA published seven CVEs against a single CareCam firmware build, one of them a privileged account that accepts an empty password. Its remediation section points users to a vendor that has not answered CISA.
The Watch · Security desk
What happened
- CISA published an advisory listing seven CVEs against one CareCam firmware build, HMT.CM2507 v251211.1507, running on CM2507 IP cameras.
- The camera's network video streaming service requires no authentication, so any host that can reach the device retrieves the live feed.
- A privileged account exposed through the camera's ONVIF management service accepts an empty password, giving a network attacker privileged management functions.
- CISA says CareCam has not responded to its attempts to coordinate, and the advisory tells users to contact the vendor themselves.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision With no build to install, the only decisions left are where the camera sits on the network and whether it stays powered.
- exposure Any host that can route to the camera can watch what the camera watches. On a flat network that includes guest wifi and one compromised workstation.
- cost A shared root hash makes the fleet the unit of remediation, so an owner with fifty of these prices fifty replacements, not one patch window.
- precedent CISA is documenting products whose makers never reply, so buyers of budget cameras should treat the advisory as the last word on the defect.
Two of the seven defects need nothing but a route to the device [13]. Two more need someone holding it [14]. The remote debugging path sits in between: an attacker already on the same local network, with the camera in a particular state, can activate a debugging service and make it remotely reachable [6].
The management login is the enumeration step. It returns device, user, media-profile and stream configuration, so the caller learns which streams exist and where they are, and the video service then serves them without asking for a credential [15].
Physical access buys more than a view. The camera runs a predetermined script from removable media without verifying its authenticity or integrity, which is arbitrary code execution in the device's own security context [7]. The bootloader is exposed on a physical debug interface with no authentication, so boot configuration, firmware data and the software the device loads can be inspected or modified [8]. The camera also stores configured wireless network credentials in cleartext [10]. Whoever gets the housing open gets the wireless key [17].
The root account password is stored using a fixed legacy hash that CISA says provides insufficient resistance to offline cracking. The advisory adds that the recovered credential "may also be reusable across other devices running the same firmware" [9]. One firmware image cracked once is then a login for every camera on that build [16].
The remediation section offers mitigation only, and it does not name a fixed firmware version [12]. What is left is placement and power. A camera reachable only from a management VLAN is still broken, and an attacker who cannot route to it cannot pull the feed.
That makes the CM2507 an inventory question: which units are on site, and which network answers for them. Replacement is the remaining control, and the buyer pays for it.
What to watch
- A CareCam reply to CISA, or any firmware build after HMT.CM2507 v251211.1507.
- Internet-wide scan counts for exposed CM2507 streaming and ONVIF services.
- The same HMT.CM2507 image turning up under other brand names, which would widen the shared root credential.