{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ja-a12-ip-camera-009_20171107-05.02.31.105/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:jooan:ja-a12:-:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111281"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["JA-A12 IP camera (009_20171107, 05.02.31.105)"],"_cs_severities":["critical"],"_cs_tags":["iot","rce","vulnerability","cve-2026-111281"],"_cs_type":"advisory","_cs_vendors":["Jooan"],"content_html":"\u003cp\u003eResearchers have identified a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-111281, affecting Jooan JA-A12 IP cameras. The vulnerability stems from the use of hard-coded credentials within the device firmware, specifically versions 009_20171107 and 05.02.31.105. An unauthenticated attacker can exploit this flaw by sending a crafted HTTP request to the device. By targeting the '/goform/SingleHandlebyCommand' endpoint with the 'singleCMD=SetDiagMode' parameter, an attacker can manipulate the jooandiag daemon to execute arbitrary commands. These commands are executed with root privileges via /bin/sh, granting the attacker full control over the affected IP camera. This flaw is particularly concerning given the device's role in network surveillance, as successful exploitation enables persistent access to internal network environments and the ability to intercept or manipulate video feeds.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS v3.1 base score of 9.8, indicating a high potential for widespread compromise. Successful exploitation grants attackers root-level access, allowing them to install persistent backdoors, pivot into the local network, or exfiltrate sensitive surveillance data. Organizations relying on Jooan JA-A12 cameras for physical security are at risk of complete surveillance system subversion.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and isolate all Jooan JA-A12 cameras from the internet to prevent unauthenticated access.\u003c/li\u003e\n\u003cli\u003eInspect network traffic logs for HTTP POST requests to the /goform/SingleHandlebyCommand endpoint containing the singleCMD=SetDiagMode parameter.\u003c/li\u003e\n\u003cli\u003eMonitor for anomalous process execution on internal camera devices if such telemetry is available via embedded diagnostics.\u003c/li\u003e\n\u003cli\u003eUpgrade affected firmware to the latest secure version provided by the manufacturer or, if unavailable, replace the vulnerable hardware units.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:40:58Z","date_published":"2026-10-15T22:40:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-jooan-rce/","summary":"Jooan JA-A12 IP cameras running specific firmware versions are vulnerable to unauthenticated remote code execution via a hard-coded credential flaw that allows command injection into the jooandiag daemon.","title":"Unauthenticated Remote Code Execution in Jooan JA-A12 IP Cameras","url":"https://feed.craftedsignal.io/briefs/2026-10-jooan-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - JA-A12 IP Camera (009_20171107, 05.02.31.105)","version":"https://jsonfeed.org/version/1.1"}