---
id: CVE-2026-97858
title: >-
  Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of
  Dynamically-Determined Object Attributes
summary: >-
  An attacker can cause the server to unbind the target device from its current
  owner and rebind it to the requesting account, regardless of whether the
  device is currently bound to a different account, allowing an attacker to
  obtain the d…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-915
vendor: 'Guangzhou Juan IoT Technology Co., Ltd.'
product: EseeCloud App
affected:
  - eseecloud_app <= 4.9.6
  - eseecloud_firmware <= 4.9.86.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:06:43.022710Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:19.972Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-97858'
references:
  - url: 'https://eseecloud.app/'
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02'
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json
tags:
  - cve.org
ingestedAt: '2026-10-16T15:11:47.136Z'
---

## Overview

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

## Affected

- `eseecloud_app <= 4.9.6`
- `eseecloud_firmware <= 4.9.86.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Guangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support  https://eseecloud.app/  .