Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-111281: Jooan JA-A12 cameras allow attackers remote control
CVE-2026-111281 · published 3 days ago
Summary
The JA‑A12 IP camera models with certain firmware versions can be accessed without a login. By sending a specially crafted request, an attacker can cause the camera to run any command as the system administrator, giving complete control of the device. Update the firmware to a fixed version or block external access to the camera’s web interface until it is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| jooan | ja-a12 | 009_20171107 |
Original advisory text
Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published15 Oct 2026
Updated16 Oct 2026
First seen15 Oct 2026
Track software like this
Free during beta