Summary
- CISA has published an advisory for CVE-2026-85083, affecting CareCam Pro IP cameras running a specific ANJIA AJL33PC0801 firmware build.
- The flaw is a hard-coded credential in the U-Boot bootloader, enabling an attacker with physical access to gain privileged bootloader access and modify firmware or system configuration.
- Exploitation requires physical access to the device — remote exploitation has not been identified.
- CareCam has not responded to CISA coordination attempts, and no patch or remediation from the vendor is available.
- CISA recommends network isolation, firewall segmentation, and restricted physical access as interim mitigations.
What the Advisory Covers
CISA published an advisory on 8 September 2026 covering a single vulnerability — CVE-2026-85083 — in the CareCam Pro IP camera line. The affected product is the ANJIA AJL33PC0801 camera running firmware version linux_linux_202008261138_svn13796, which incorporates the U-Boot 2010.06 bootloader compiled in August 2020. The devices are manufactured by a China-headquartered company and deployed worldwide, including in commercial facilities classified as critical infrastructure.
Nature of the Vulnerability
The issue is classified under CWE-798, Use of Hard-coded Credentials. The ANJIA AJL33PC0801 camera’s bootloader relies on a credential that is baked into the firmware rather than generated or configurable per device. An attacker who gains physical access to a unit can use that credential to authenticate to the bootloader, at which point they may modify firmware, alter system configuration, or achieve what the advisory describes as complete device compromise.
Scoring and Attack Vector
Under CVSS 3.1, the vulnerability carries a base score of 6.8 (Medium), with the physical attack vector (AV:P) being the primary factor limiting the score. Under the newer CVSS 4.0 framework, the same vulnerability scores 7.0 (High). Both assessments reflect high impact across confidentiality, integrity, and availability, tempered by the requirement for physical proximity. CISA has confirmed that no remote exploitation path has been identified, and no known public exploitation specifically targeting this vulnerability has been reported.
No Patch Available — Vendor Silent
This is where the advisory becomes operationally uncomfortable for security teams. CareCam has not responded to CISA’s coordination attempts, meaning there is no vendor-supplied patch, no firmware update, and no official guidance from the manufacturer. CISA has encouraged users to contact CareCam directly, but with coordination having already failed at the agency level, organisations should not expect a timely vendor response. The firmware version in question dates to August 2020, which raises additional questions about the product’s ongoing support status.
Physical Access Is Not a Trivial Qualifier
It is tempting to discount physical-access vulnerabilities in network security discussions, but IP cameras occupy spaces where physical access by third parties — contractors, cleaning staff, maintenance crews, or visitors — is routine. A camera installed in a commercial facility lobby, car park, or server room corridor may be within reach of individuals who would not otherwise have network-level access. The bootloader modification capability means a compromised device could subsequently be used as a persistent foothold, a surveillance tool under attacker control, or a pivot point if the device sits on a network segment with broader connectivity.
Recommended Interim Measures
In the absence of a vendor patch, CISA’s recommended practices centre on reducing exposure and limiting the blast radius. Organisations should ensure affected cameras are not reachable from the internet and are isolated behind firewalls, separated from core business networks. Where remote access to camera systems is necessary, VPN connections are preferred, with the caveat that VPN security depends on the patching state of the VPN infrastructure itself. Physical security controls — tamper-evident housings, restricted access to camera hardware, and regular inspection — are also pertinent given the attack vector. Researcher Omkar Mali is credited with reporting the vulnerability to CISA.
Why it matters
IP cameras are frequently treated as low-priority network endpoints, yet they sit on internal networks, capture sensitive environments, and — as this advisory illustrates — can carry firmware-level vulnerabilities that survive indefinitely when vendors are unresponsive. For CISOs managing commercial facilities or overseeing third-party physical security integrations, this advisory is a prompt to audit the camera inventory for affected models, verify network segmentation around surveillance infrastructure, and establish a process for managing unpatched IoT devices where vendor remediation is unavailable. The absence of a patch combined with vendor silence means this risk must be managed through compensating controls alone.
What to do now
- Audit your environment for CareCam Pro ANJIA AJL33PC0801 cameras running the affected firmware version (linux_linux_202008261138_svn13796 / U-Boot 2010.06 compiled 2020-08-26).
- Isolate affected devices from business networks and ensure they are not accessible from the internet.
- Place surveillance network segments behind dedicated firewalls with restrictive ingress and egress rules.
- Apply physical security controls to camera hardware — restrict physical access and consider tamper-evident measures where practical.
- If remote access to camera systems is required, route it through a current, fully patched VPN.
- Attempt to contact CareCam directly regarding remediation, as CISA advises, and document the outcome for your risk register.
- Monitor CISA’s ICS advisory pages for any update to this advisory should a patch or vendor response emerge.
