CVE-2026-97858CWE-915

CVE-2026-97858

Medium · published October 16, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00255 · 16.2th percentile
Weakness
CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2026-10-16T18:19Z
References (3)
https://eseecloud.app/ · [email protected]https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02 · [email protected]
EPSS history
Timeline
  • 18 OCT 03:33Z
    EPSS moved — → 0%
    epss
  • 16 OCT 14:04Z
    Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes
    cvelistv5
  • 16 OCT 14:04Z
    Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes
    cvelistv5