[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQJ3lL1Idn3m_TkeNBuBQEctGttw6rXF0HvkgRpE472U":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"1a7ea36b-0ab3-4125-99ff-e9b00b591aff","hard-coded-credentials-in-eseecloud-ip-cameras-leave-users-exposed","205624b2-9a4c-4608-81df-3d45ed07bfa0","Hard-Coded Credentials in EseeCloud IP Cameras Leave Users Exposed","EseeCloud IP cameras manufactured by Guangzhou Juan IoT Technology contain hard-coded credentials and improper modification controls, meaning attackers who discover these static credentials can gain full control of affected devices with no additional effort. Hard-coded credentials are a fundamental design flaw that cannot be mitigated by end users changing passwords, since the credentials are embedded directly in firmware. The vendor's failure to respond to CISA's coordinated disclosure attempts compounds the risk, leaving potentially millions of users with no official patch or mitigation path. This case highlights the broader danger of IoT devices shipped with insecure-by-design configurations, where the attack surface is invisible to the average consumer.","**Immediate actions:**\n- Isolate all EseeCloud IP cameras from the public internet by placing them behind a firewall or disabling remote access features until a patch is available.\n- Conduct an asset inventory to identify all affected EseeCloud devices running app versions up to 4.9.6 or firmware up to 4.9.86.0 across your environment.\n\n**Long-term improvements:**\n- Establish a formal IoT procurement policy that requires vendors to demonstrate secure-by-design practices, including the absence of hard-coded credentials, before devices are approved for purchase.\n- Implement a regular firmware and software update cycle for all IoT and OT devices, with automated scanning to detect outdated or vulnerable versions.\n- Require vendors to provide a Software Bill of Materials (SBOM) and a defined vulnerability disclosure and patching SLA as contractual obligations.\n\n**Detection measures:**\n- Deploy network monitoring tools to detect anomalous outbound traffic or unauthorized access attempts originating from IoT camera segments.\n- Subscribe to CISA ICS advisories and threat intelligence feeds to receive early warning of newly disclosed vulnerabilities in operational technology and IoT products.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-213: IoT Device Cybersecurity Guidance","NIST IA-5: Authenticator Management (prohibiting hard-coded credentials)","NIST SA-4: Acquisition Process (secure supply chain requirements)","NIST IR-6: Incident Reporting","IEC 62443-4-2: Security for Industrial Automation and Control Systems – Component Requirements","ETSI EN 303 645: Cyber Security for Consumer IoT (Clause 5.1 – No universal default passwords)","GDPR Article 32: Security of Processing (applicable if cameras capture personal data)",{},"published","2026-10-15T18:21:38.596291+00:00","2026-10-15T18:21:38.566+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-288-02","guangzhou-juan-iot-technology-eseecloud-769eb8","Guangzhou Juan IoT Technology EseeCloud",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[51,54,58],{"slug":34,"name":52,"problem":53},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":55,"name":56,"problem":57},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":59,"name":60,"problem":61},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection."]