Remote Code Execution in JAIOTlink C492A-W6 Firmware

Executive Summary

CVE-2026-58454 is a remote code execution vulnerability affecting JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware version 4.8.30.57701411. Authenticated attackers can exploit this flaw by writing malicious shell scripts to a writable persistent storage path (JFFS2) on the device. They then trigger execution of these scripts through an authenticated HTTP endpoint (/Anyka/config) that uses the popen() function to run a configuration file. This allows attackers to execute arbitrary code persistently, even surviving device reboots.

The vulnerability arises because the device executes a fixed file path (/etc/jffs2/anyka_cfg.ini) via popen() without properly validating or restricting the content, enabling code injection if an attacker can write to that file. Exploitation requires authentication and the ability to write to the persistent storage, which can be achieved through secondary attack methods such as command injection via the SetMAC command or staging scripts on an SD card.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to persistent remote code execution on affected IP cameras, allowing an attacker with authentication to run arbitrary shell scripts on the device. This can compromise the device's integrity, confidentiality, and availability.

• Attackers can gain persistent control over the camera, potentially using it as a foothold within a network.
• Malicious scripts can survive device reboots, making remediation more difficult.
• Attackers could manipulate camera functions, intercept or alter video streams, or use the device to launch further attacks.
• The vulnerability requires authentication, so impact depends on the attacker's ability to authenticate or exploit other vulnerabilities to gain access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of the writable persistent JFFS2 storage file `/etc/jffs2/anyka_cfg.ini` and monitoring requests to the authenticated HTTP endpoint `/Anyka/config` which triggers execution of this file.

Detection commands may include:

• Checking if the file `/etc/jffs2/anyka_cfg.ini` exists and is executable on the device.
• Monitoring HTTP requests to the `/Anyka/config` endpoint to identify suspicious or unauthorized access.
• Using network tools like tcpdump or Wireshark to capture traffic and filter for requests to `/Anyka/config`.
• If you have shell access, commands like `ls -l /etc/jffs2/anyka_cfg.ini` to check file presence and permissions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting authenticated access to the vulnerable HTTP endpoint `/Anyka/config` to prevent attackers from triggering execution.

Additionally, removing or disabling the writable persistent storage file `/etc/jffs2/anyka_cfg.ini` or making it non-executable can prevent malicious scripts from being staged and executed.

Other recommended actions are to avoid using `popen()` for executing configuration files and to treat such files strictly as data, not executable code.

If possible, update the device firmware to a version that addresses this vulnerability or apply vendor-provided patches.

Useful 0 Not Useful 0