Medium
Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.
Announced Source revision 1
Original source ↗CVE-2026-97858
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-97858
EseeCloud App
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
EseeCloud Firmware
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Guangzhou Juan IoT Technology Co., Ltd.",
"product": "EseeCloud App",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "4.9.6"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Guangzhou Juan IoT Technology Co., Ltd.",
"product": "EseeCloud Firmware",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "4.9.86.0"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-97858
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #32634 · Revision 1
- Added to Heist Feed
- Publisher date