OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-85478

LOW · CVSS 3.5 EPSS 0.22% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-18 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The CM2507 IP camera's firmware exposes an interactive bootloader via a physical debug interface, allowing unauthorized access without authentication. This vulnerability enables an attacker with physical access to manipulate boot configurations and firmware, potentially compromising the device's integrity. Organizations utilizing this camera model should prioritize addressing this issue to mitigate risks associated with physical tampering.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-85478
Severity
LOW
CVSS
3.5
EPSS
0.22%

Original NVD Description

A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.