Jooan JA-A12: Unauthenticated remote code execution via hard-coded credentials
Summary
Jooan JA-A12 IP cameras with firmware 009_20171107 or 05.02.31.105 contain hard-coded credentials that allow unauthenticated network attackers to execute root commands. An attacker sends a crafted SetDiagMode request to the /goform/SingleHandlebyCommand endpoint, which makes the jooandiag daemon run attacker-supplied commands via /bin/sh. The result is full control of the camera, and the device can then be used as a foothold into the internal network. The CVSS 4.0 score is 9.3 (critical).
Affected
- Jooan JA-A12 IP cameras with firmware 009_20171107
- Jooan JA-A12 IP cameras with firmware 05.02.31.105
- Per the CVE record, the default configuration is unaffected.
Fixed in
Unknown. No fixed firmware or vendor advisory was found.
Workaround
- Block external access to the /goform/SingleHandlebyCommand endpoint with firewall rules, or disable the web interface if possible (third-party recommendation, not from the vendor).
- Isolate cameras on a separate VLAN.
- Remove any port forwarding or UPnP mappings to the cameras.
- Place the camera behind a VPN if it cannot be secured otherwise.
Exploitation
- CISA SSVC in the CVE record: exploitation status 'poc', automatable 'yes', technical impact 'total'.
- A public proof of concept is indicated, but VulDB states no exploit is available; this conflict is unresolved.
- Not listed in CISA KEV.
- No reports of active exploitation found.
- EPSS is below 1%.
Our recommendation
- Inventory all Jooan JA-A12 cameras and check their firmware versions.
- Remove internet exposure immediately and block the affected endpoint at the firewall.
- Segment the cameras from the main network and monitor their outbound traffic and logs for unexpected connections.
- Replace or retire units without a vendor fix, and recheck Jooan's support pages and NVD for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials www.vulncheck.com
- Rahul R: From Temu to Root: Breaking the Jooan C9TS rahulr.in
- OpenCVE: CVE-2026-111281 app.opencve.io
- VulDB: CVE-2026-111281 vuldb.com
- EUVD-2026-102472 vulners.com
- Positive Technologies PT-2026-115272 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:34.
Original description (NVD)
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.