CVE-2026-81305: Carecam hmt.cm2507 Firmware

Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.

CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical access to the device could supply a malicious script and execute arbitrary code in the security context of the affected device.

Affected products

• Carecam hmt.cm2507 Firmware: version v251211.1507 only

Published 2026-09-18. Last modified 2026-09-19.