CVE-2026-105664 Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy
An attacker with a valid token can enumerate registered devices by observing response discrepancies, exposing device inventory information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105664?
CVE-2026-105664 is a medium-severity vulnerability in Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization - to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale.
Weakness: CWE-204
Which versions are affected by CVE-2026-105664?
How do I fix CVE-2026-105664?
No fix has been published for CVE-2026-105664 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-105664 being exploited?
There is no known exploitation of CVE-2026-105664 in the wild and no public exploit code.
Sources
Also known as GHSA-cm9q-hmj5-h2w5.