Hard-coded credential flaw in CareCam Pro cameras
CareCam Pro IP cameras use a hard-coded bootloader credential that could let a physically-present attacker fully compromise the device.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory detailing CVE-2026-85083, a hard-coded credential vulnerability (CWE-798) affecting CareCam Pro IP cameras built on the ANJIA AJL33PC0801 hardware platform running a specific Linux/U-Boot bootloader firmware build. The hard-coded credential protects bootloader authentication; an attacker with physical access to the device could use it to gain privileged bootloader access, enabling unauthorized firmware modification and full device compromise.
The vulnerability requires physical access and is not remotely exploitable, limiting its scope primarily to scenarios where an attacker can gain hands-on access to deployed cameras (e.g., theft, tampering, or supply-chain interdiction). CareCam, a China-headquartered vendor with worldwide deployment in the Commercial Facilities sector, has not responded to CISA's coordination attempts, so no vendor patch or firmware update is currently available. CISA recommends standard ICS network hardening (isolating devices from business networks and the internet, using VPNs for remote access) as compensating controls, though these do not address the physical-access attack vector directly. No in-the-wild exploitation has been reported.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-251-01
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs