---
id: CVE-2026-97858
title: >-
  An attacker can cause the server to unbind the target device from its current
  owner and rebind it to the requesting account, regardless of whether the
  device is currently bound to a different account, allowing an attacker to
  obtain the d…
summary: >-
  An attacker can cause the server to unbind the target device from its current
  owner and rebind it to the requesting account, regardless of whether the
  device is currently bound to a different account, allowing an attacker to
  obtain the d…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-915
vendor: 'Guangzhou Juan IoT Technology Co., Ltd.'
product: EseeCloud App
affected:
  - eseecloud_app <= 4.9.6
  - eseecloud_firmware <= 4.9.86.0
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:04:29.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97858'
references:
  - url: 'https://eseecloud.app/'
    label: ics-cert@hq.dhs.gov
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json
    label: ics-cert@hq.dhs.gov
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02'
    label: ics-cert@hq.dhs.gov
tags:
  - nvd
  - cve.org
epss: 0.0029
epssPercentile: 0.21465
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:06:43.022710Z'
ingestedAt: '2026-10-16T15:11:47.136Z'
---

## Overview

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.