{"id":"CVE-2026-111281","title":"Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials","summary":"Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-798"],"vendor":"Jooan","product":"JA-A12","affected":["JA-A12 009_20171107","JA-A12 05.02.31.105"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T21:43:25.321Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111281","references":[{"url":"https://rahulr.in/reversing-a-cheap-ip-camera-to-root/"},{"url":"https://www.vulncheck.com/advisories/jooan-ja-a12-unauthenticated-root-rce-via-setdiagmode-hard-coded-credentials","label":"VulnCheck Advisory: Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials"}],"tags":["cve.org"],"ingestedAt":"2026-10-15T22:48:25.448Z","slug":"CVE-2026-111281","body":"## Overview\n\nJooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.\n\n## Affected\n\n- `JA-A12 009_20171107`\n- `JA-A12 05.02.31.105`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}