{"id":"CVE-2026-111281","title":"Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials","summary":"Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-798"],"vendor":"Jooan","product":"JA-A12","affected":["JA-A12 009_20171107","JA-A12 05.02.31.105"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-21T01:40:03.850293Z"},"exploitAvailable":true,"published":"2026-10-15","updated":"2026-10-21","sourceUpdated":"2026-10-21T01:40:14.038Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111281","references":[{"url":"https://rahulr.in/reversing-a-cheap-ip-camera-to-root/"},{"url":"https://www.vulncheck.com/advisories/jooan-ja-a12-unauthenticated-root-rce-via-setdiagmode-hard-coded-credentials","label":"VulnCheck Advisory: Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials"}],"tags":["cve.org","exploit-available"],"epss":0.00561,"epssPercentile":0.46455,"ingestedAt":"2026-10-15T22:48:25.448Z","slug":"CVE-2026-111281","body":"## Overview\n\nJooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.\n\n## Affected\n\n- `JA-A12 009_20171107`\n- `JA-A12 05.02.31.105`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":226815,"id":"CVE-2026-111281","ts":1792550358125,"field":"exploit_available","old":"false","new":"true"}]}