CVE-2026-56718 Overview
CVE-2026-56718 is a path traversal vulnerability [CWE-22] in AJCloud AJY IPC firmware versions prior to 01.10715.11.37. The flaw resides in the jdbhttpd web service and allows unauthenticated remote attackers to read arbitrary files with root privileges. Attackers supply path traversal sequences in the HTTP request URI to bypass directory restrictions. Successful exploitation exposes cleartext Real Time Streaming Protocol (RTSP) credentials, Wi-Fi Service Set Identifier (SSID) and pre-shared key, device serial number, and cloud binding parameters.
Critical Impact
Unauthenticated remote attackers can retrieve sensitive credentials and network configuration from affected IP cameras by sending crafted HTTP requests to port 80.
Affected Products
- AJCloud AJY IPC firmware versions prior to 01.10715.11.37
- Devices exposing the jdbhttpd web service on TCP port 80
- IP camera products built on the affected AJCloud firmware base
Discovery Timeline
- 2026-08-30 - CVE-2026-56718 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-56718
Vulnerability Analysis
The jdbhttpd service handles HTTP requests on TCP port 80 without enforcing authentication. It also fails to normalize or sanitize path components supplied in the request URI. A remote attacker submits directory traversal sequences to escape the intended web root and reach files on the underlying Linux filesystem. Because the service runs as root, every file readable by the operating system is exposed to the attacker.
The returned data includes RTSP credentials in cleartext, the Wi-Fi SSID and pre-shared key, the device serial number, and cloud binding parameters. These artifacts enable video stream hijacking, lateral movement to the wireless network, and takeover of the camera's cloud identity. Attackers can chain the leaked cloud binding data with the vendor's mobile application to remotely control the camera.
Root Cause
The root cause is the absence of canonical path validation in the jdbhttpd request handler. The service concatenates attacker-controlled URI segments with the document root and passes the result to file open routines without rejecting .. sequences. Running the process as root removes the last filesystem boundary that could have limited disclosure.
Attack Vector
Exploitation requires network reachability to TCP port 80 on the camera and no credentials. The attacker sends a single HTTP GET request containing path traversal sequences targeting known configuration and credential files. The vulnerability mechanism is described in the VulnCheck Advisory for AJ Cloud; no verified proof-of-concept code is included here.
Detection Methods for CVE-2026-56718
Indicators of Compromise
- HTTP requests to TCP port 80 on AJY IPC devices containing ../ or URL-encoded traversal sequences such as %2e%2e%2f in the URI
- Access attempts targeting configuration files that contain RTSP credentials, Wi-Fi keys, or cloud binding tokens
- Unexpected outbound RTSP sessions or new cloud bindings originating from the camera after suspicious HTTP traffic
Detection Strategies
- Inspect web access logs on jdbhttpd for URIs containing traversal patterns or references to sensitive filesystem paths
- Deploy network intrusion detection signatures that flag directory traversal payloads directed at IP camera management ports
- Correlate camera HTTP activity with subsequent RTSP authentication attempts from unfamiliar source addresses
Monitoring Recommendations
- Log all inbound HTTP requests to camera management interfaces and retain them for retrospective analysis
- Alert on any external source reaching port 80 of internal IP camera subnets, as these devices should not be publicly reachable
- Track Wi-Fi authentication events and cloud account activity for the same credentials stored on the affected devices
How to Mitigate CVE-2026-56718
Immediate Actions Required
- Upgrade AJCloud AJY IPC firmware to version 01.10715.11.37 or later
- Remove affected cameras from any internet-exposed network path and place them behind a segmented VLAN
- Rotate RTSP credentials, Wi-Fi pre-shared keys, and cloud binding tokens on every potentially exposed device
Patch Information
AJCloud addresses the flaw in firmware version 01.10715.11.37. Refer to the VulnCheck Advisory for AJ Cloud and the AJ Cloud Website for firmware distribution and update procedures.
Workarounds
- Block inbound access to TCP port 80 on affected cameras using an upstream firewall or router access control list
- Restrict management access to a dedicated administrative VLAN reachable only through a VPN
- Disable Universal Plug and Play (UPnP) on the local router to prevent the camera from automatically exposing port 80 to the internet
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
