CVE-2026-84398 Overview
CM2507 IP cameras accept an empty password for a privileged account exposed through the ONVIF (Open Network Video Interface Forum) management service. An attacker with network access to the device can authenticate without credentials and reach privileged management functions. Successful exploitation exposes device configuration, user accounts, media profiles, and stream settings. The weakness is classified under [CWE-258: Empty Password in Configuration File]. CISA published this issue in ICS Advisory ICSA-26-258-08.
Critical Impact
Unauthenticated network attackers can reach a privileged ONVIF account and retrieve sensitive device, user, and stream configuration data without any credentials.
Affected Products
- CM2507 IP cameras exposing the ONVIF management service
- Deployments where the ONVIF interface is reachable over the network
- Environments using default or unhardened camera credentials
Discovery Timeline
- 2026-09-18 - CVE-2026-84398 published to the National Vulnerability Database
- 2026-09-19 - Last updated in NVD database
- ICSA-26-258-08 - CISA ICS Advisory released covering this vulnerability
Technical Details for CVE-2026-84398
Vulnerability Analysis
The CM2507 IP camera exposes management operations through ONVIF, a standardized SOAP-based protocol for IP video devices. A privileged account on the device accepts an empty password value during authentication. Any client that submits a request with the privileged username and no password succeeds. The vulnerability requires only network reachability to the ONVIF endpoint.
Once authenticated, an attacker can invoke ONVIF management operations to enumerate device metadata, user accounts, media profiles, and RTSP stream URIs. The disclosed information can be used to pivot into video streams, harvest additional credentials, or map the surrounding network. The CVSS 4.0 vector reflects a confidentiality-focused impact with no integrity or availability effects called out.
Root Cause
The root cause is an insecure configuration in which a privileged ONVIF account ships with, or permits, an empty password [CWE-258]. Authentication logic treats the empty credential as valid rather than rejecting it or forcing a password change on first use. This design flaw removes the authentication boundary for administrative ONVIF calls.
Attack Vector
Exploitation occurs over the network against the camera's ONVIF service, typically on the HTTP port used for device management. An attacker sends a standard ONVIF SOAP request such as GetDeviceInformation, GetUsers, GetProfiles, or GetStreamUri using WS-UsernameToken authentication with the privileged username and an empty password field. The device processes the request and returns configuration data. No user interaction and no prior access are required.
See the CISA ICS Advisory ICSA-26-258-08 and the GitHub CSAF JSON File for the authoritative technical description.
Detection Methods for CVE-2026-84398
Indicators of Compromise
- ONVIF SOAP requests to camera management endpoints containing a UsernameToken with an empty Password element
- Unexpected calls to GetUsers, GetDeviceInformation, GetProfiles, or GetStreamUri from non-management hosts
- Outbound RTSP sessions to camera stream URIs originating from unknown clients following ONVIF enumeration
Detection Strategies
- Inspect HTTP traffic to camera ONVIF ports for SOAP Envelope bodies containing WS-Security headers with empty password values
- Correlate first-time source IPs communicating with camera management interfaces against an approved VMS allowlist
- Alert on successful ONVIF authentication events from addresses outside the video management network segment
Monitoring Recommendations
- Log and forward camera and switch access logs to a centralized analytics platform for baseline and anomaly review
- Monitor for scanning patterns targeting TCP ports commonly used by ONVIF services across camera VLANs
- Track configuration read operations against IP cameras and flag bursts consistent with automated enumeration
How to Mitigate CVE-2026-84398
Immediate Actions Required
- Restrict network access to the camera's ONVIF management interface to trusted video management system hosts only
- Set a strong, unique password on every ONVIF account, especially any privileged or administrative accounts
- Place cameras on an isolated VLAN with no direct exposure to the internet or general user networks
- Audit existing accounts on affected CM2507 devices and disable or remove unused privileged accounts
Patch Information
No vendor patch is referenced in the NVD record at the time of publication. Refer to the CISA ICS Advisory ICSA-26-258-08 for vendor-supplied mitigation guidance and firmware updates. Apply firmware updates from the device manufacturer as soon as they become available.
Workarounds
- Block inbound traffic to ONVIF and RTSP ports at the perimeter and at internal segmentation boundaries
- Enforce firewall rules that permit ONVIF communication only from the video management server
- Require VPN or jump-host access for any remote administration of camera infrastructure
- Rotate credentials on all camera accounts and validate that empty passwords are rejected during authentication testing
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.