---
title: CISA ICS advisories: unpatched hard-coded login in EseeCloud cameras (9.8), dcm4chee PACS missing auth (9.1), Eclipse Milo OPC UA auth bypass | ctxsec
url: https://ctxsec.com/items/cisa-ics-oct15-milo-dcm4chee-eseecloud
description: ""
status: "confirmed (CISA advisories)"
published: 2026-10-15
---

> 

[← Cybersecurity News](/news) · [markdown](/items/cisa-ics-oct15-milo-dcm4chee-eseecloud.md)

confirmed (CISA advisories)

2026-10-15

### CISA ICS advisories: unpatched hard-coded login in EseeCloud cameras (9.8), dcm4chee PACS missing auth (9.1), Eclipse Milo OPC UA auth bypass

CISA published five ICS/medical advisories on Oct 15. ICSA-26-288-02: Guangzhou Juan IoT EseeCloud app (4.9.6 and earlier) and firmware (4.9.86.0 and earlier) have three flaws, including a hard-coded credential that lets an attacker log in to devices (CVE-2026-107617, CVSS 9.8); the vendor didn't respond to CISA, so there is no fix. ICSMA-26-288-02: J4Care dcm4chee-arc-light 5.35.1 has six CVEs, including missing authorization that lets an unauthenticated attacker delete stored medical images (CVSS 9.1), inject forged studies, reassign patient records or cause a DoS; fixed in 5.35.2. ICSA-26-288-01: Eclipse Milo 0.6.0–1.1.4 has five bugs, including a Call-service batching flaw that lets an anonymous client run a denied method by batching it with an allowed one (CVE-2026-62927); fixed in 1.1.5, with no 0.6.x fix. Also out: Thermo Fisher Torrent Suite path traversal (fixed in 5.22) and CISA's own Malcolm. None is reported as exploited.

Sources: [ICSA-26-288-02 EseeCloud](https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02) · [ICSMA-26-288-02 dcm4che](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02) · [ICSA-26-288-01 Eclipse Milo](https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01) · [ICSMA-26-288-01 Torrent Suite](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01)