{"id":"CVE-2026-97858","title":"An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the d…","summary":"An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the d…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-915"],"vendor":"Guangzhou Juan IoT Technology Co., Ltd.","product":"EseeCloud App","affected":["eseecloud_app <= 4.9.6","eseecloud_firmware <= 4.9.86.0"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:04:29.760","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97858","references":[{"url":"https://eseecloud.app/","label":"ics-cert@hq.dhs.gov"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json","label":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02","label":"ics-cert@hq.dhs.gov"}],"tags":["nvd","cve.org"],"epss":0.0029,"epssPercentile":0.21465,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:06:43.022710Z"},"ingestedAt":"2026-10-16T15:11:47.136Z","slug":"CVE-2026-97858","body":"## Overview\n\nAn attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}