CVE-2026-111281 is a hard-coded credentials flaw (CWE-798) in Jooan JA-A12 IP cameras, scored 9.8 critical. It affects firmware 009_20171107 and 05.02.31.105. An unauthenticated attacker can run commands as root. The record names no fix, so isolate the cameras and plan to replace them.
What's affected
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105, per the CVE record. The record names no fixed firmware, and I did not find a vendor advisory. Check with the vendor or the seller before you assume a patch exists.
Per the record, a diagnostic mode handler in the camera web service accepts attacker chosen values together with credentials that are built into the firmware. A background diagnostic daemon then runs commands through the shell as root. The researcher write up behind the advisory describes reversing the firmware of a low cost camera. Details beyond that are not repeated here.
How to check if you're exposed
Inventory your cameras. Check the label or the web page or app for the model and read the firmware version from the settings page. If it matches one of the two listed versions, treat the camera as affected.
Look at the network next. Find out whether the camera's web service is reachable from the internet through port forwarding or cloud relay, and whether it sits on the same network as business systems. Check your firewall and router for forwards to camera addresses.
Check for odd behavior such as unexpected outbound connections, reboots or changed settings.
You can also run the free in-browser dependency scan or browse the Gold directory to see where a package or product shows up in your stack.
What to do now
- Remove any port forward or direct internet exposure for the cameras.
- Move the cameras to a separate network segment with no route to business systems, and block outbound traffic except what they truly need.
- Ask the vendor or seller for a firmware update and apply it if one exists.
- Treat cameras that were exposed as possibly compromised. Factory reset them only after you have isolated them.
- If no fix appears, replace the cameras with a model from a vendor that publishes security updates.
Why it matters
Credentials built into the firmware are the same for every device. Once anyone learns them, every camera with that firmware is open. The class is CWE-798. The record adds that the daemon runs commands as root, so a successful call gives full device control.
Cameras are a common foothold because they are rarely patched, sit inside the network, and can watch the people who use it. The right answer for low cost devices without updates is usually network isolation, and replacement when the vendor does not respond.
The record does not flag this CVE as exploited in the wild and it is not a CISA Known Exploited Vulnerability.
Quick check
Can I fix this with a stronger password?
No. The record says the credentials used are built into the firmware, so changing the web password does not remove the flaw.
What is the best mitigation?
Take the camera off the internet and isolate it from other systems. Replace it if the vendor does not ship a fix.
Sources
Last reviewed: 19 October 2026.
