CVE-2026-111281

CriticalCVSS 9.8/10Last modified Oct 21, 2026

Description

Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2026
Last modified: Oct 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1112828.2Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers byp CVE-2026-1112839.0BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated atta CVE-2026-1112845.4Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject CVE-2026-111296.5Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a CVE-2026-111308.8Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a c CVE-2026-111319.6Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro CVE-2026-1113118.8The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPres CVE-2026-1113127.7OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELET CVE-2026-1113136.5JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authentica CVE-2026-111326.5Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via CVE-2026-1113206.5ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backen CVE-2026-1113215.4TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send ar