The vulnerability arises from a hard‑coded credential that allows an attacker to authenticate to the EseeCloud App or Firmware. Once logged in, the attacker gains full administrative privileges, enabling potential modification of device configuration, unauthorized data access, or further exploitation of the device.

The affected products are Guangzhou Juan IoT Technology Co., Ltd.'s EseeCloud App and EseeCloud Firmware. Users of these devices are susceptible to the credential issue whenever the devices are reachable over the network.

With a CVSS score of 9.3 the vulnerability is considered critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the presence of hard‑coded credentials makes exploitation trivial on any reachable device. The likely attack vector is remote over network interfaces that expose the EseeCloud services, and no workaround other than contacting the vendor is provided.