CISA has published an ICS advisory covering seven vulnerabilities in CareCam CM2507 IP cameras (firmware v251211.1507). Several directly impact credential and access security, including missing authentication for critical functions (CVE-2026-88259), an empty password in a configuration file, cleartext storage of sensitive information, and use of a password hash with insufficient computational effort. Together these could let an unauthenticated attacker on the network access live video, recover stored credentials, enable unauthorized services, and execute arbitrary code.
For identity security, the credential-recovery and weak-hashing issues are the most concerning: harvested credentials from IoT devices are frequently reused elsewhere and can serve as an initial foothold for lateral movement into corporate or identity infrastructure. Cameras deployed in commercial facilities worldwide widen the potential exposure.
What to take away: Treat IoT/camera credentials as part of your broader identity attack surface. Segment these devices, rotate any credentials, and monitor for reuse of exposed passwords against directory services.