Jooan JA-A12 CVE-2026-111281

No special conditions beyond network reachability - remote unauthenticated exploitation works against default configurations of the Jooan JA-A12 camera because the credentials are hard-coded (CWE-798) and shipped in firmware. The concrete prerequisites are: the target runs affected firmware 009_20171107 or 05.02.31.105, the HTTP interface exposing /goform/SingleHandlebyCommand is reachable from the attacker, and the jooandiag daemon is active to process the SetDiagMode command. The primary limiting factor is exposure: cameras behind NAT/firewalls without inbound access or port-forwarding are not remotely reachable, confining practical attacks to LAN-adjacent attackers or internet-exposed devices.

All available signals point to a genuine high-priority issue rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) describes trivial remote exploitation with no authentication, no user interaction, and low complexity, yielding full compromise - consistent with the description of unauthenticated root RCE through hard-coded credentials. Publicly available exploit code exists (a detailed reverse-engineering write-up and a VulnCheck advisory), which materially raises real-world risk because the technique is documented end-to-end. No EPSS score was provided in the input, so exploitation probability cannot be quantified here, and the CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation despite public POC availability - POC presence and active exploitation are distinct signals. The main factor tempering overall organizational risk is deployment footprint: this is a low-cost consumer IP camera, so widespread enterprise exposure is unlikely even though any exposed device is easily and fully compromised. Net: technically severe and easily weaponized, but impact is bounded by the niche product footprint and internet-exposure of the affected cameras.

An attacker with network reachability to a Jooan JA-A12 camera's web interface sends an unauthenticated HTTP request to /goform/SingleHandlebyCommand setting singleCMD=SetDiagMode with an attacker-chosen authserverip and authcode. The jooandiag daemon passes these attacker-controlled values to /bin/sh, executing arbitrary commands as root and granting full device takeover. Public exploit code and a reverse-engineering walkthrough already demonstrate the full chain.