An attacker who possesses a valid access token but lacks additional authentication can exploit a response difference on the EseeCloud endpoint that processes device ID values. When an ID that does not exist is supplied, the service returns a distinct error code compared to a request with a valid, registered ID. The lack of rate limiting combined with the full 10‑digit numeric ID space turns this observable discrepancy into an enumeration oracle, allowing a malicious actor to systematically discover the identifiers of registered IoT devices in the network.

The affected product is Guangzhou Juan IoT Technology Co., Ltd.'s EseeCloud platform, including both the web application and the firmware. No specific version numbers are provided in the advisory, so all current releases of the App and Firmware should be considered potentially vulnerable until a vendor patch is released.

The advisory assigns a CVSS v3.1 score of 6.9, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalogue. An attacker can leverage the enumeration oracle without needing elevated privileges, however the requirement of a valid access token still imposes a low barrier to exploitation. The absence of rate limiting means discovery can be performed at scale, leading to a high volume of requests that could eventually impact availability or provide a basis for targeted follow‑up attacks.