Jooan JA-A12 cameras: hard-coded diagnosis login gives root on the local network, no fix listed

On 15 October 2026 NVD published CVE-2026-111281 against Jooan JA-A12 IP cameras on firmware builds 009_20171107 and 05.02.31.105. VulnCheck rates it 9.3 on CVSS v4.0. Anyone who can reach the camera's local HTTP interface can enable a vendor diagnosis mode with credentials baked into the Cam720 Android app, then feed shell commands to the jooandiag daemon as root. NVD lists no fixed firmware.

How the chain works

The Cam720 app hides a technician diagnosis flow. When that flow starts, the phone asks Jooan's cloud for an authorisation code and then calls http://<camera-ip>/goform/SingleHandlebyCommand with singleCMD=SetDiagMode. The request carries userid=admin and userkey set to the MD5 of admin123 - the same pair on every device, recoverable from the APK. It also tells the camera which LAN address and port should receive the diagnosis session.

The camera's jooanipc process accepts that request and arms jooandiag over a local UNIX socket. The daemon opens a TCP connection back to the address from the request, sends the auth code in clear text, and treats later AES-encrypted payloads as shell commands unless they contain the keepalive string DiagnosisStatus. An attacker on the same network can skip the cloud entirely: pick any six-digit auth code, send SetDiagMode with the hard-coded password hash, listen for the callback and deliver an encrypted command. Researchers Rahul R, Abdulrahman Aldossary and Saleh Alghamdi demonstrated a root shell this way; the write-up also covers related C9-line cameras that share the diagnosis path.

What it means at home

The flaw needs network reachability to the camera's web port, not an internet-facing exploit by itself. In a flat home Wi-Fi that is still a low bar: a compromised phone, guest laptop or another IoT gadget on the same subnet is enough. With root on the camera an attacker can watch the stream, change configuration and use the device as a foothold toward the rest of the LAN.

NVD cites no patched build. One of the listed firmwares dates from 2017. Until Jooan ships a fixed image that removes the hard-coded login and hardens jooandiag, the practical steps are isolation and replacement: keep every JA-A12 off the internet (no port forwards, no UPnP), put cameras on a separate VLAN that can only talk to the recorder, and plan to swap unmaintained units for a model that still receives updates. Check the firmware string on each camera against the two builds above; treat unknown or older builds as vulnerable until the vendor says otherwise.