CVE-2026-111281

Received Received - Intake

Remote Code Execution in Jooan JA-A12 IP Cameras

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111281

Affected Vendors & Products

Vendor	Product	Version / Range
Jooan	JA-A12	009_20171107
Jooan	JA-A12	05.02.31.105

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability is a remote code execution flaw in Jooan JA-A12 IP cameras running specific firmware versions. It allows unauthenticated attackers to execute root commands on the device using hard-coded credentials. Attackers send a crafted request to the camera's web interface, which triggers the jooandiag daemon to run arbitrary commands via /bin/sh, giving full control of the device.

Detection Guidance

Check for unauthorized access to the /goform/SingleHandlebyCommand endpoint with the singleCMD=SetDiagMode parameter. Inspect network traffic for requests containing hard-coded credentials or unexpected commands sent to the jooandiag daemon.

Impact Analysis

This vulnerability allows attackers to gain complete control over the affected IP camera. They could access live video feeds, disable the camera, install malware, or use the device as a pivot point to attack other systems on the network. Since the camera is internet-facing, attackers can exploit it remotely without physical access.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR if the camera is used in a setting where it captures personal data, as unauthorized access may constitute a data breach. For HIPAA, if the camera monitors healthcare environments, the breach could expose protected health information. Organizations must ensure such vulnerabilities are patched to maintain compliance.

Mitigation Strategies

Immediately update the camera firmware to the latest version. Block external access to the /goform/SingleHandlebyCommand endpoint via firewall rules. Disable any unused services or ports on the device.

Hi! I’m here to help you understand CVE-2026-111281. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70