CVE-2026-56718

AJCloud AJY IPC camera firmware before version 01.10715.11.37 contains a path traversal vulnerability (CWE-22) in the jdbhttpd web service. An unauthenticated remote attacker can send a crafted HTTP request with traversal sequences in the URI to TCP port 80, causing the service to return files from anywhere on the device's filesystem. Because the flaw allows reads with root privileges, an attacker can retrieve highly sensitive files, including cleartext RTSP credentials, the Wi-Fi SSID and pre-shared key, the device serial number, and cloud binding parameters, potentially enabling further compromise of the camera and the network it joins. Any AJY IPC device running affected firmware is vulnerable, with risk highest for cameras whose port 80 is reachable from the internet. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS estimates a 0.6% chance of exploitation in the next 30 days, and the issue is not in CISA's KEV catalog.

What to do: Upgrade AJY IPC firmware to version 01.10715.11.37 or later. Until patched, restrict TCP port 80 on the camera to trusted networks or a VPN rather than exposing it directly to the internet, and treat stored Wi-Fi and RTSP credentials as potentially compromised—rotate the Wi-Fi passphrase and RTSP passwords after updating. Review camera logs for HTTP requests to port 80 containing traversal sequences (e.g., ../) as a sign of probing or exploitation.