CVE-2026-111281
9.8CriticalPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-798
Impact
Unauthenticated attackers can execute commands as root and take over the device remotely over the network. They only need HTTP access to the camera's web interface.
Root cause
The web interface accepts diagnostic commands authorized with hard-coded credentials and passes parameters directly to /bin/sh via the jooandiag daemon.
Affected systems
Jooan JA-A12 IP cameras with firmware versions 009_20171107 and 05.02.31.105
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No fixed firmware version is provided in the advisory; isolate affected cameras from untrusted networks and block access to the web interface (specifically HTTP requests to /goform/SingleHandlebyCommand).
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.