MajorCritical vulnerability

CVE-2026-84398 (CVSS 8.7)

NVD · officialPublished Sep 18, 2026Risk 37/100EPSS 0.2%

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information.

Technical details

CVSS

8.7

AV:NetworkAC:LowPR:NoneUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source