CVE-2026-56718 in AJY IPC
Summary
by MITRE • 08/30/2026
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/30/2026
The vulnerability identified within AJCloud AJY IPC firmware versions prior to 01.10715.11.37 represents a critical security flaw rooted in improper input validation within the jdbhttpd web service component. This specific implementation error manifests as a path traversal vulnerability, which allows unauthenticated remote attackers to manipulate file system access controls by injecting directory traversal sequences into HTTP request URIs. The core technical failure lies in the server's inability to properly sanitize or canonicalize user-supplied input before processing it against the local file system. By utilizing standard path manipulation techniques such as dot-dot-slash sequences, an attacker can bypass intended directory restrictions and navigate up the file hierarchy from the web root to access arbitrary locations on the device’s storage medium. This flaw effectively neutralizes the isolation boundaries that are typically enforced by web server configurations, granting the attacker direct read access to files regardless of their original permissions or location within the system structure.
The operational impact of this vulnerability is severe due to the privilege level at which the jdbhttpd service operates and the nature of the data exposed. Because the process runs with root privileges, any file accessed through this path traversal mechanism inherits those elevated rights, allowing attackers to read files that are normally protected from standard user-level access. This capability enables the exfiltration of highly sensitive configuration and credential data stored on the device. Specifically, adversaries can retrieve cleartext Real-Time Streaming Protocol credentials, which compromise video stream integrity and confidentiality by exposing authentication tokens used for remote viewing. Furthermore, attackers can extract Wi-Fi network identifiers including Service Set Identifiers and pre-shared keys, facilitating unauthorized wireless network access or man-in-the-middle attacks against other devices on the same local area network. The exposure of device serial numbers aids in targeted supply chain attacks or specific model exploitation efforts, while cloud binding parameters reveal how the device connects to remote management services, potentially allowing attackers to hijack administrative control over the IoT endpoint.
From a classification perspective, this vulnerability aligns with Common Weakness Enumeration identifier CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory. The exploitation technique corresponds directly to MITRE ATT&CK tactic TA0001, Initial Access, specifically leveraging techniques associated with exploiting publicly exposed applications or services that lack proper authentication mechanisms. Since the attack vector is remote and requires no prior access credentials, it falls under network-based attacks where the attacker interacts with the service over TCP port 80 without any form of user interaction or social engineering. The absence of an authentication gate before path validation significantly lowers the barrier to entry for malicious actors, making this a high-severity issue that can be exploited by automated scanning tools and script-kiddies alike.
Mitigation strategies must prioritize immediate patching as the primary defense mechanism. Administrators should upgrade AJCloud AJY IPC firmware to version 01.10715.11.37 or later, where this path traversal flaw has been remediated through improved input sanitization and strict file access controls within the jdbhttpd service. In scenarios where immediate patching is not feasible due to operational constraints, network-level mitigations should be implemented to restrict exposure of port 80 to trusted internal networks only, effectively placing a firewall rule or Access Control List between potential attackers and the vulnerable web service. Additionally, deploying an Intrusion Detection System capable of detecting HTTP path traversal patterns can provide early warning indicators of exploitation attempts. Long-term architectural improvements should include enforcing principle of least privilege for all backend services, ensuring that even if input validation fails, the underlying process does not possess root-level access to sensitive configuration files containing credentials or cryptographic keys.