CVE-2026-85083

MEDIUM 6.8

CareCam Pro IP Cameras Use of Hard-coded Credentials

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially resulting in complete device compromise.

CWE	CWE-798
Vendor	carecam
Product	anjia ajl33pc0801 firmware
Published	Sep 11, 2026
Last Updated	Sep 11, 2026

Stay Ahead of the Next One

Get instant alerts for carecam anjia ajl33pc0801 firmware

Be the first to know when new medium vulnerabilities affecting carecam anjia ajl33pc0801 firmware are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

CareCam / ANJIA AJL33PC0801 Firmware

linux_linux_202008261138_svn13796 / Bootloader U-Boot 2010.06 (compiled 2020-08-26)

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-251-01 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-251-01.json

Credits

Omkar Mali reported this vulnerability to CISA.