The vulnerability allows an unauthenticated attacker to execute arbitrary commands at root level on Jooan JA‑A12 IP cameras. By sending a specially crafted request that includes the SetDiagMode command, the camera’s jooandiag daemon runs the supplied command through /bin/sh. This flaw is caused by hard‑coded credentials that grant root access without any authentication checks. The impact is complete control over the device, including firmware modification, persistence, data exfiltration, or leveraging the camera as a foothold in the network.

Affected devices are Jooan JA‑A12 IP cameras running firmware versions 009_20171107 or 05.02.31.105. Any camera model listed under the Jooan:JA-A12 vendor that matches these firmware strings is vulnerable.

The CVSS score of 9.3 classifies this flaw as critical. The EPSS score is <1%, indicating a very low but nonzero exploitation probability, and the vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is network‑based; the flaw is triggered by an unauthenticated HTTP request to /goform/SingleHandlebyCommand. Because no authentication is required, an attacker with network access could exploit the camera remotely, gaining full control and potentially compromising other assets connected to the same network.