Hard-Coded Credentials in EseeCloud IP Cameras Leave Users Exposed
EseeCloud IP cameras manufactured by Guangzhou Juan IoT Technology contain hard-coded credentials and improper modification controls, meaning attackers who discover these static credentials can gain full control of affected devices with no additional effort. Hard-coded credentials are a fundamental design flaw that cannot be mitigated by end users changing passwords, since the credentials are embedded directly in firmware. The vendor's failure to respond to CISA's coordinated disclosure attempts compounds the risk, leaving potentially millions of users with no official patch or mitigation path. This case highlights the broader danger of IoT devices shipped with insecure-by-design configurations, where the attack surface is invisible to the average consumer.
Tactical Insight
Immediate actions
- Isolate all EseeCloud IP cameras from the public internet by placing them behind a firewall or disabling remote access features until a patch is available.
- Conduct an asset inventory to identify all affected EseeCloud devices running app versions up to 4.9.6 or firmware up to 4.9.86.0 across your environment.
Long-term improvements
- Establish a formal IoT procurement policy that requires vendors to demonstrate secure-by-design practices, including the absence of hard-coded credentials, before devices are approved for purchase.
- Implement a regular firmware and software update cycle for all IoT and OT devices, with automated scanning to detect outdated or vulnerable versions.
- Require vendors to provide a Software Bill of Materials (SBOM) and a defined vulnerability disclosure and patching SLA as contractual obligations.
Detection measures
- Deploy network monitoring tools to detect anomalous outbound traffic or unauthorized access attempts originating from IoT camera segments.
- Subscribe to CISA ICS advisories and threat intelligence feeds to receive early warning of newly disclosed vulnerabilities in operational technology and IoT products.