Is CVE-2026-100906 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100906 being exploited in the wild.

How severe is CVE-2026-100906?

Medium severity, with a CVSS score of 5.3, published 28 September 2026.

Is there a fix for CVE-2026-100906?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100906 attacked?

It is attacked over the network or from the adjacent network, in a network appliance.

Am I affected by CVE-2026-100906?

Check whether you run Eyeplus IP Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100906: Eyeplus IP Camera unauthenticated ONVIF GetUsers credential disclosure

CVE-2026-100906 · Severity: medium · CVSS 5.3 · Published 2026-09-28

Eyeplus IP cameras contain a flaw in their ONVIF device management API that allows attackers on the local network to retrieve administrator credentials in plaintext without authentication. An attacker with network access to the camera can extract the administrator username and password, enabling complete device compromise and lateral movement within the network.

Technologies: Eyeplus IP Camera. Vendors: Eyeplus.

Quick answers

Is CVE-2026-100906 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100906 being exploited in the wild.
How severe is CVE-2026-100906?: Medium severity, with a CVSS score of 5.3, published 28 September 2026.
Which products and versions are affected?: Eyeplus IP Camera 57.0.0.0308.
Is there a fix for CVE-2026-100906?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100906 attacked?: It is attacked over the network or from the adjacent network, in a network appliance.
Am I affected by CVE-2026-100906?: Check whether you run Eyeplus IP Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ONVIF GetUsers API endpoint at /onvif/Device is exposed without authentication, allowing unauthenticated SOAP requests to enumerate user accounts and retrieve plaintext passwords. The vulnerability requires network adjacency (same LAN segment) and no user interaction, allowing an attacker to directly query the API via HTTP POST. This enables unauthorized disclosure of administrative credentials and potential further exploitation of ONVIF/HTTP authenticated services on the device.

Affected products

Eyeplus IP Camera 57.0.0.0308

Timeline

2026-09-28: disclosed: Vulnerability published
2026-09-28: other: Exploit code is now public

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.