Anyone who can reach the network a CareCam CM2507 camera sits on can ask it for the live video feed, and the camera will hand it over. No password, no login. CISA published that finding on September 15 as one of eight industrial advisories released the same day, and paired with a second advisory on Digital Watchdog video recorders it adds up to 13 flaws in the equipment organizations buy specifically to keep an eye on their own premises.
The camera nobody is going to fix
The CareCam advisory covers HMT.CM2507 firmware v251211.1507 and lists seven vulnerabilities, reported to CISA by Ben Law. The unauthenticated video stream (CVE-2026-88259, CVSS 7.5) is the one most likely to matter in practice. Alongside it, the camera accepts an empty password for a privileged account reachable through ONVIF, a standard protocol for managing IP cameras, which hands an attacker device, user and stream configuration details (CVE-2026-84398, CVSS 7.5).
Two more are quieter but uglier. The camera stores the Wi-Fi network name and pre-shared key of whatever network it joined in cleartext on its own filesystem (CVE-2026-81321), and it protects the root account with a legacy password hash weak enough to crack offline, a credential CISA notes may be reusable across other devices running the same firmware (CVE-2026-85497). Both are scored 9.3 critical under CVSS 4.0.
The remediation section of that advisory is one sentence long: CareCam has not responded to CISA's attempts to coordinate. There is no patch, no advisory of the vendor's own, and no indication one is coming. CareCam is headquartered in China and the product is deployed worldwide.
Plaintext admin logins on the recorder
Digital Watchdog's VMAX line is the other half of the day. Six flaws affect every version of the VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4 Recorder and VG4 Recorder. Scot Berner of TrustedSec reported them. The two scored 9.6 critical are a missing authorization problem on the recorder's state-changing web functions (CVE-2026-66887) and hard-coded credentials that run the FTP service as root, giving remote root file access wherever FTP is reachable (CVE-2026-66890).
A third, CVE-2026-68953, is an authentication bypass: a crafted HTTP request makes the recorder disclose sensitive device information, including administrator credentials in plaintext. CISA's summary of what successful exploitation buys is blunt, saying it could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point.
One limit matters here. CISA states these vulnerabilities are not exploitable remotely, and the scoring bears that out, with the vectors assuming an attacker already on the adjacent network. That makes the VMAX flaws an escalation and persistence story rather than an internet-wide scanning one. Digital Watchdog is a US company, and CISA maps the affected gear to commercial facilities, government services, healthcare and transportation.
Download the firmware, or segment the camera
For the VMAX recorders there is a real fix. Digital Watchdog has released updated firmware for every affected model, available per model at digital-watchdog.com/downloads/. Apply it.
For CareCam there is nothing to apply, so the answer is network design: put the cameras on their own segment, keep them off the internet, and do not let them reach business systems. CISA reports no known public exploitation of either set of flaws at this time, which is the window in which this work is cheap. Exposed camera fleets do get found and inventoried at scale, as the 14,500 camera hijacking operation uncovered in August showed, and an unfixable device is not a reason to leave it reachable. It is the same bind as the fuel systems shipping years-old bugs with no fix: when the vendor is silent, the network is the only control left.
The full technical detail is in CISA's advisories for CareCam CM2507 and the Digital Watchdog VMAX lineups.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.