CVE-2026-111281 in JA-A12
Summary
by MITRE • 10/16/2026
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The Jooan JA-A12 IP camera series, specifically those running firmware versions 009_20171107 and 05.02.31.105, suffers from a critical remote code execution vulnerability rooted in the improper handling of administrative authentication mechanisms. This flaw allows unauthenticated attackers to gain full control over the device by exploiting hardcoded credentials embedded within the firmware's diagnostic interface. The vulnerability is located in the web server component that processes HTTP requests directed at the /goform/SingleHandlebyCommand endpoint. By manipulating specific parameters, an attacker can bypass standard access controls and execute arbitrary system commands with root privileges, effectively compromising the integrity and availability of the surveillance infrastructure.
The technical mechanism of this exploit involves sending a specifically crafted HTTP POST request to the target device. The payload requires setting the parameter singleCMD=SetDiagMode while simultaneously providing custom values for authserverip and authcode parameters. These parameters are designed to authenticate requests against an external authentication server, but due to the presence of hardcoded credentials within the firmware, the validation logic is flawed or easily bypassed. When these conditions are met, the device's jooandiag daemon processes the request without verifying the legitimacy of the caller. The daemon then passes user-supplied input directly into a shell execution context via /bin/sh. This lack of input sanitization and command injection prevention allows an attacker to inject arbitrary Linux commands that are executed with root-level permissions, granting complete control over the operating system running on the camera.
From an operational perspective, this vulnerability poses severe risks to network security and physical safety. An attacker who exploits this flaw can install persistent backdoors, exfiltrate sensitive video footage, or use the compromised device as a pivot point for further attacks against other systems on the local network. In industrial IoT contexts, such as smart cities or critical infrastructure monitoring, compromising these cameras could lead to significant surveillance gaps or enable malicious actors to disrupt operations by disabling security feeds. The ability to execute commands as root means that attackers can modify system configurations, install malware, and potentially launch distributed denial-of-service attacks using the compromised devices as part of a botnet.
This vulnerability aligns with CWE-798, which describes the use of hardcoded credentials for authentication or authorization, and CWE-78, which covers OS command injection. Furthermore, in terms of the MITRE ATT&CK framework, this exploit maps to T1053 Scheduled/Task Job, as it involves executing commands through system utilities, and potentially T1190 Exploit Public-Facing Application if the camera is directly accessible from the internet. The presence of hardcoded credentials also reflects CWE-259, which addresses the use of passwords in configuration files or code that are not changed after deployment.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary solution is to apply firmware updates provided by Jooan if available, as manufacturers often release patches to fix hardcoded credential issues and improve input validation on web interfaces. If no patch exists, network segmentation should be implemented to isolate IP cameras from critical internal networks, restricting access only through trusted management VLANs. Additionally, administrators should disable any unused diagnostic ports or services that expose the /goform/SingleHandlebyCommand endpoint to untrusted networks. Regular vulnerability scanning and penetration testing are recommended to identify similar misconfigurations in IoT devices before they can be exploited by malicious actors.