Is CVE-2026-100907 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100907 being exploited in the wild.

How severe is CVE-2026-100907?

Medium severity, with a CVSS score of 5.3, published 28 September 2026.

Which products and versions are affected?

Eyeplus IP Camera 57.0.0.0308; YCC365 Plus 1620P WiFi IP Camera 57.0.0.0308.

Is there a fix for CVE-2026-100907?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100907 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-100907?

Check whether you run Eyeplus IP Camera or YCC365 Plus 1620P WiFi IP Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100907: Eyeplus IP Camera unauthenticated snapshot disclosure in p2pcam service

CVE-2026-100907 · Severity: medium · CVSS 5.3 · Published 2026-09-28

Eyeplus IP cameras allow attackers on the local network to retrieve camera snapshots without authentication by accessing an HTTP endpoint. An attacker can repeatedly capture images of what the camera monitors without needing login credentials, compromising the privacy of areas under surveillance.

Technologies: Eyeplus IP Camera. Vendors: Eyeplus.

Quick answers

Is CVE-2026-100907 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100907 being exploited in the wild.
How severe is CVE-2026-100907?: Medium severity, with a CVSS score of 5.3, published 28 September 2026.
Which products and versions are affected?: Eyeplus IP Camera 57.0.0.0308; YCC365 Plus 1620P WiFi IP Camera 57.0.0.0308.
Is there a fix for CVE-2026-100907?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100907 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-100907?: Check whether you run Eyeplus IP Camera or YCC365 Plus 1620P WiFi IP Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The p2pcam HTTP service on TCP port 8001 exposes a /snapshot endpoint that returns JPEG images without authentication or authorization checks (CWE-306, CWE-200). An attacker with LAN access can send a simple unauthenticated GET request to retrieve live camera frames. The vulnerability affects Eyeplus IP cameras and rebranded variants like YCC365 Plus, with confirmed impact on firmware version 57.0.0.0308.

Affected products

Eyeplus IP Camera 57.0.0.0308
YCC365 Plus 1620P WiFi IP Camera 57.0.0.0308

Timeline

2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.