CVE-2026-100906

5.5 mediumEPSS 0.3%

Medium (5.5). EPSS 0.3% chance of exploitation in the next 30 days.

A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipulation results in information disclosure. The attack can be executed remotely. The exploit is now public and may be used.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-284
Published: 2026-09-28
Modified: 2026-09-28
Record from: the NVD, synced 2026-10-19

References

https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-GetUsers-Unauth-Plaintext-Password.md
https://vuldb.com/cve/CVE-2026-100906
https://vuldb.com/submit/919771
https://vuldb.com/vuln/410857
https://vuldb.com/vuln/410857/cti

Check your stack JSON