Jooan IP Cameras Have Critical RCE Flaw Allowing Unauthenticated Root Access
A critical vulnerability in Jooan JA-A12 cameras lets attackers run root commands via hard-coded credentials, granting full device control without authentication.
Key points
- CVE-2026-111281 is rated Critical with a CVSS score of 9.3.
- The flaw affects Jooan JA-A12 cameras running specific firmware versions.
- Attackers can execute arbitrary commands as root through the jooandiag daemon.
The National Vulnerability Database has recorded a critical remote code execution vulnerability in Jooan JA-A12 IP cameras. This flaw allows unauthenticated attackers to execute root-level commands on affected devices by exploiting hard-coded credentials within the system.
The vulnerability, identified as CVE-2026-111281, carries a CVSS base score of 9.3, which classifies it as critical. According to the NVD record, the weakness stems from CWE-798, indicating the use of hard-coded credentials. This design flaw enables attackers to bypass authentication mechanisms entirely and gain full control over the compromised camera hardware.
Technical details of the exploit
The attack vector involves sending a specific request to the /goform/SingleHandlebyCommand endpoint on the target device. Attackers include the parameter singleCMD=SetDiagMode along with an attacker-chosen authserverip and authcode. This input triggers the jooandiag daemon to process the command.
Once the daemon processes the request, it executes the attacker’s commands through /bin/sh. This execution happens with root privileges, giving the attacker complete administrative control over the device. The NVD description notes that this allows for arbitrary code execution without requiring any prior authentication or valid user credentials.
Affected firmware versions
The vulnerability specifically impacts Jooan JA-A12 IP cameras running two distinct firmware versions. The affected builds are firmware 009_20171107 and firmware 05.02.31.105. Devices running these specific versions are susceptible to the remote code execution attack described in the CVE record.
No other Jooan camera models or firmware versions are listed in the current NVD record for this specific vulnerability. Users of other Jooan products or different firmware builds are not indicated as affected by this particular flaw.
What should you do?
No patch, fix, or update for this vulnerability has been confirmed yet. Administrators should verify the firmware version of their Jooan JA-A12 cameras immediately. If the device is running one of the affected versions, it should be isolated from networks that are accessible to untrusted users.
What to do and how to stay safe: Jooan
- Inventory all Jooan JA-A12 cameras to check if they run firmware 009_20171107 or 05.02.31.105.
- Isolate affected devices from external networks to prevent unauthenticated remote exploitation.
- Monitor network traffic for connections to the /goform/SingleHandlebyCommand endpoint on camera ports.
- Wait for the vendor to release a firmware update that addresses the hard-coded credential issue.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111281?
The CVSS score is 9.3, which is classified as critical by the National Vulnerability Database.
Which Jooan camera models are affected by this vulnerability?
Only the Jooan JA-A12 IP cameras are listed as affected in the NVD record.
Is there a fix available for this remote code execution flaw?
No fix has been confirmed yet; no patch or update is mentioned in the source material.
