The Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy vulnerability allows an attacker with a valid access token to distinguish valid ID values from a 10-digit numeric search space due to an observable response discrepancy. This discrepancy, combined with the absence of meaningful rate limiting, enables an enumeration oracle for discovering registered devices at scale.
MEDIUMGuangzhou Juan IoT Technology Co., Ltd.CVE published 2026-10-16
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID. This vulnerability affects IoT devices using EseeCloud App and Firmware. Defenders should assess exposure and prioritize mitigation to prevent devi [truncated]
