Unauthenticated Remote Code Execution in Jooan JA-A12 IP Cameras

Researchers have identified a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-111281, affecting Jooan JA-A12 IP cameras. The vulnerability stems from the use of hard-coded credentials within the device firmware, specifically versions 009_20171107 and 05.02.31.105. An unauthenticated attacker can exploit this flaw by sending a crafted HTTP request to the device. By targeting the '/goform/SingleHandlebyCommand' endpoint with the 'singleCMD=SetDiagMode' parameter, an attacker can manipulate the jooandiag daemon to execute arbitrary commands. These commands are executed with root privileges via /bin/sh, granting the attacker full control over the affected IP camera. This flaw is particularly concerning given the device's role in network surveillance, as successful exploitation enables persistent access to internal network environments and the ability to intercept or manipulate video feeds.

Impact

The vulnerability carries a CVSS v3.1 base score of 9.8, indicating a high potential for widespread compromise. Successful exploitation grants attackers root-level access, allowing them to install persistent backdoors, pivot into the local network, or exfiltrate sensitive surveillance data. Organizations relying on Jooan JA-A12 cameras for physical security are at risk of complete surveillance system subversion.

Recommendation

• Identify and isolate all Jooan JA-A12 cameras from the internet to prevent unauthenticated access.
• Inspect network traffic logs for HTTP POST requests to the /goform/SingleHandlebyCommand endpoint containing the singleCMD=SetDiagMode parameter.
• Monitor for anomalous process execution on internal camera devices if such telemetry is available via embedded diagnostics.
• Upgrade affected firmware to the latest secure version provided by the manufacturer or, if unavailable, replace the vulnerable hardware units.