{"id":"CVE-2026-111281","published":"2026-10-15T22:19:29.457","lastModified":"2026-10-16T18:25:45.343","description":"Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-798"],"vendors":[],"products":[],"references":[{"url":"https://rahulr.in/reversing-a-cheap-ip-camera-to-root/","tags":[]},{"url":"https://www.vulncheck.com/advisories/jooan-ja-a12-unauthenticated-root-rce-via-setdiagmode-hard-coded-credentials","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Jooan JA-A12 IP camera contains hard-coded credentials that allow unauthenticated remote code execution, enabling attackers to run arbitrary commands as root on the device. This vulnerability affects multiple firmware versions and allows full device compromise without authentication.","exploitability":"Exploitation is extremely easy with no prerequisites - attackers simply need to send a single HTTP request to /goform/SingleHandlebyCommand with crafted parameters to trigger command execution as root.","blast_radius":"The vulnerability affects all Jooan JA-A12 cameras running firmware versions 009_20171107 or 05.02.31.105, potentially exposing thousands of devices to remote compromise with minimal effort from attackers.","remediation":"Upgrade to firmware version 05.02.31.106 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","hardcoded-credentials","ip-camera","ics"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:46:23.217Z"}}