CVE-2026-100906 Eyeplus CVE debrief

Who should care

Defenders responsible for managing and securing Eyeplus devices, especially those using ONVIF-enabled components, should assess their exposure to this vulnerability. IT and security teams overseeing networked security devices should verify if their inventory includes affected versions and plan for remediation.

Why it matters

CVE-2026-100906 is a medium-severity vulnerability in Eyeplus 57.0.0.0308 that can lead to information disclosure via the ONVIF protocol. Defenders should verify exposure, update device configurations, and monitor for exploitation attempts.

• Verify exposure of ONVIF-enabled Eyeplus devices to potential information disclosure
• Assess and limit access to ONVIF components to prevent unauthorized data access
• Monitor network traffic for signs of exploitation attempts targeting this vulnerability

Technical summary

The vulnerability is located in the GetUsers function of the /onvif/Device component in Eyeplus 57.0.0.0308. This function is part of the ONVIF (Open Network Video Interface Forum) protocol, which is used for communication between IP-based security devices. The vulnerability allows for information disclosure, potentially exposing sensitive user data. The CVSS score of 5.5 indicates a medium severity level, with the attack vector being network-based (AV:N), requiring low attack complexity (AC:L), and no privileges (PR:N).

Defensive priority

Defenders should prioritize verifying exposure of ONVIF-enabled Eyeplus devices, especially those accessible remotely.

Recommended defensive actions

• Verify exposure of ONVIF-enabled Eyeplus devices, especially those accessible remotely
• Review and update device configurations to limit access to ONVIF components
• Monitor for potential exploitation attempts targeting this vulnerability
• Assign an owner to track remediation progress for affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail page provide official information about the vulnerability. Additional details are available from source references, including a GitHub advisory and Vuldb entries. The vulnerability has been publicly disclosed, and defenders should verify exposure of ONVIF-enabled Eyeplus devices, especially those accessible remotely. The information provided is based on available data and may not be exhaustive.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.