CVE-2026-111281

waiting for further signals

GHSA-vf5m-2wrp-785c ↗EUVD-2026-102472 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

jooan JA-A12 009_20171107; 05.02.31.105

ETK-2026-1740, permanent identifier

cvss9.8cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5d 04h 19msince last run

17mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+3h45m

+2h

+6h

+8h

+10h

+12h

description

Jooan JA-A12 IP cameras using firmware 009_20171107 or 05.02.31.105 are affected by hard-coded credentials in a diagnostic function. An unauthenticated attacker who can reach the camera's network management service can execute commands as root and take control of the device.

mitigation

Restrict access to affected cameras' management services to trusted administrative networks and block Internet exposure. Obtain and apply vendor-supported updated firmware if available; the evidence does not identify a fixed release.

check

exploit

automation

–

auth required

EPSS

0.56%45th percentile

agent run time

17m

cve.org record, t = 0

2026-10-15 21:43Z

Δ to public poc

–

Δ to kev

–

outcome

No artifact: an exploit or check was attempted but could not be produced at this moment.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-15 21:43Z
ghsa: trigger signal, started the run
https://github.com/advisories/GHSA-vf5m-2wrp-785c
2026-10-15 21:43Z
cve.org record for CVE-2026-111281
cve_org · https://www.cve.org/CVERecord?id=CVE-2026-111281

this entry in the feed

GET /api/v1/feed/CVE-2026-111281

{
  "etk_id": "ETK-2026-1740",
  "cve_id": "CVE-2026-111281",
  "display_id": "CVE-2026-111281",
  "ghsa_id": "GHSA-vf5m-2wrp-785c",
  "euvd_id": "EUVD-2026-102472",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Hard-coded credential command execution in Jooan JA-A12",
  "summary": "Jooan JA-A12 IP cameras using firmware 009_20171107 or 05.02.31.105 are affected by hard-coded credentials in a diagnostic function. An unauthenticated attacker who can reach the camera's network management service can execute commands as root and take control of the device.",
  "mitigation": "Restrict access to affected cameras' management services to trusted administrative networks and block Internet exposure. Obtain and apply vendor-supported updated firmware if available; the evidence does not identify a fixed release.",
  "vendor": "jooan",
  "product": "JA-A12",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "009_20171107",
        "05.02.31.105"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "JA-A12",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0056,
  "epss_percentile": 0.4558,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 17.0933688,
  "t0_at": "2026-10-15T21:43:25.321000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-15T21:43:25.321000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T21:43:25.321000+00:00",
      "url": "https://github.com/advisories/GHSA-vf5m-2wrp-785c"
    }
  }
}

published 2026-10-16 01:10Z
last change 2026-10-21 05:31Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.