A critical flaw in Jooan JA-A12 IP camera firmware lets remote attackers run commands as root without logging in, which gives them full control of the device.
What Is It
CVE-2026-111281 is a remote code execution vulnerability in Jooan JA-A12 IP cameras. It is caused by hard-coded credentials (CWE-798). According to the NVD record, an attacker sends singleCMD=SetDiagMode to the /goform/SingleHandlebyCommand endpoint and supplies their own authserverip and authcode values. The jooandiag daemon then runs the attacker's commands through /bin/sh with root privileges, which gives the attacker full control of the device.
VulnCheck reported the issue, and NVD published it on October 15, 2026. The NVD record status is currently "Received."
Why It Matters
VulnCheck scored the flaw 9.8 (CRITICAL) under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 (CRITICAL) under CVSS 4.0. In practice, this means:
- The attacker can do it over the network
- The attack is easy to carry out
- The attacker doesn't need an account, and nobody has to click anything
- A successful attacker can read data, change it, and shut the device down
If exploitation succeeds, the attacker can run commands as root, which would give them full control of an affected JA-A12 camera running one of the listed firmware versions. At the time of writing, the supplied CISA Known Exploited Vulnerabilities (KEV) data has no entry for this CVE, so KEV does not confirm that attackers are using it. The references include a public technical write-up on reversing the camera to get root.
What's Vulnerable
| Vendor | Product | Affected Firmware |
|---|---|---|
| Jooan | JA-A12 | 009_20171107 |
| Jooan | JA-A12 | 05.02.31.105 |
The record lists all other versions as unaffected by default. NVD has not published any CPE entries yet.
Patch Status
The supplied sources do not mention a vendor patch, fixed firmware version or official fix instructions. There is also no CISA KEV required action, because the CVE is not in the KEV catalog. Owners of affected JA-A12 devices should check the VulnCheck advisory and the vendor for updates. Until fixed firmware is confirmed, assume that anyone who can reach an affected camera's /goform/SingleHandlebyCommand endpoint over the network can take it over completely. Limit network access to these cameras.