Cpe:2.3:h:jooan:ja-A12:-:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3hjooanja-a12-/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 15 Oct 2026 22:40:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnauthenticated Remote Code Execution in Jooan JA-A12 IP Camerashttps://feed.craftedsignal.io/briefs/2026-10-jooan-rce/Thu, 15 Oct 2026 22:40:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-jooan-rce/Jooan JA-A12 IP cameras running specific firmware versions are vulnerable to unauthenticated remote code execution via a hard-coded credential flaw that allows command injection into the jooandiag daemon.Researchers have identified a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-111281, affecting Jooan JA-A12 IP cameras. The vulnerability stems from the use of hard-coded credentials within the device firmware, specifically versions 009_20171107 and 05.02.31.105. An unauthenticated attacker can exploit this flaw by sending a crafted HTTP request to the device. By targeting the '/goform/SingleHandlebyCommand' endpoint with the 'singleCMD=SetDiagMode' parameter, an attacker can manipulate the jooandiag daemon to execute arbitrary commands. These commands are executed with root privileges via /bin/sh, granting the attacker full control over the affected IP camera. This flaw is particularly concerning given the device's role in network surveillance, as successful exploitation enables persistent access to internal network environments and the ability to intercept or manipulate video feeds.

Impact

The vulnerability carries a CVSS v3.1 base score of 9.8, indicating a high potential for widespread compromise. Successful exploitation grants attackers root-level access, allowing them to install persistent backdoors, pivot into the local network, or exfiltrate sensitive surveillance data. Organizations relying on Jooan JA-A12 cameras for physical security are at risk of complete surveillance system subversion.

Recommendation

  • Identify and isolate all Jooan JA-A12 cameras from the internet to prevent unauthenticated access.
  • Inspect network traffic logs for HTTP POST requests to the /goform/SingleHandlebyCommand endpoint containing the singleCMD=SetDiagMode parameter.
  • Monitor for anomalous process execution on internal camera devices if such telemetry is available via embedded diagnostics.
  • Upgrade affected firmware to the latest secure version provided by the manufacturer or, if unavailable, replace the vulnerable hardware units.
]]>criticaladvisoryiotrcevulnerabilitycve-2026-111281