Vulnerability · Published Sep 28, 2026 · Assigned by VulDB
CVE-2026-100906Eyeplus ONVIF Device GetUsers information disclosure
Medium 5.3
In plain English
A medium-severity information exposure in Eyeplus. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 78.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipulation results in information disclosure. The attack can be executed remotely. The exploit is now public and may be used.
Affected products (as reported)
Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
References
- VDB-410857 | Eyeplus ONVIF Device GetUsers information disclosure vdb-entry, technical-description
- VDB-410857 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-100906 | CVE Analysis and Report third-party-advisory
- Submit #919771 | Eyeplus EYEPLUS_DEV 57.0.0.0308 Information Disclosure third-party-advisory
- https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-GetUsers-Unauth-Plaintext-Password.md exploit