CVE-2026-58453: JAIOTlink Camera Auth Bypass Vulnerability

CVE-2026-58453 is an authentication bypass vulnerability in JAIOTlink C492A-W6 Wi-Fi IP cameras caused by hard-coded credentials. Attackers can exploit this to access camera streams and configurations. This article covers technical details, affected firmware versions, impact assessment, and mitigation strategies.

CVE-2026-58453 Overview

CVE-2026-58453 is a hard-coded credentials vulnerability [CWE-1392] in JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411. The anyka_ipc HTTP service on port 80 accepts the default admin username paired with an empty password. Network-adjacent attackers can authenticate without brute forcing or credential theft. Once authenticated, attackers reach camera snapshots, live video streams, network configuration data, and factory-level API endpoints, including the SetMAC command injection surface.

Critical Impact
Unauthenticated network attackers can access live video, exfiltrate network configuration, and pivot to command injection through factory API endpoints on affected cameras.

Affected Products

JAIOTlink C492A-W6 Wi-Fi IP Camera
Firmware version 4.8.30.57701411
anyka_ipc HTTP service on TCP port 80

Discovery Timeline

2026-07-01 - CVE-2026-58453 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58453

Vulnerability Analysis

The JAIOTlink C492A-W6 ships with a default administrator account whose password is empty. The anyka_ipc HTTP daemon listening on port 80 accepts this credential pair as valid authentication. Any client on the same network segment as the camera can send HTTP requests using admin and no password to gain full administrative access.

After authentication, the attacker interacts with the camera's HTTP API. This includes retrieval of JPEG snapshots, RTSP stream credentials, Wi-Fi and network configuration, and factory-level maintenance endpoints. One of these endpoints, SetMAC, is documented as a command injection surface, enabling arbitrary command execution on the underlying embedded Linux system.

Root Cause

The root cause is the shipping of production firmware with a hard-coded administrative credential [CWE-1392] and no requirement to change or set a password on first boot. The anyka_ipc service performs no additional out-of-band authentication or per-device secret verification before granting privileged API access.

Attack Vector

Exploitation requires network reachability to the camera's HTTP port 80. In typical home or small business deployments, the camera is reachable across the local wireless or wired network. An attacker sends an HTTP request to the camera authenticating as admin with an empty password, then invokes API endpoints for surveillance or issues crafted SetMAC payloads to execute commands. No user interaction is required, and no exploit tooling beyond a standard HTTP client is needed. Full technical details are documented in the VulnCheck Advisory on Hard-Coded Credentials and the GitHub Default Credentials Writeup.

Detection Methods for CVE-2026-58453

Indicators of Compromise

HTTP requests to port 80 on JAIOTlink C492A-W6 cameras carrying Authorization: Basic YWRtaW46 (base64 of admin:).
Unexpected access to /snapshot, /stream, or factory API endpoints such as SetMAC from non-administrator hosts.
Outbound connections from the camera to unfamiliar external IPs following API access.
New or modified system processes on the camera consistent with post-exploitation command injection.

Detection Strategies

Inventory network segments for JAIOTlink C492A-W6 devices and fingerprint the anyka_ipc HTTP banner on TCP port 80.
Alert on successful HTTP Basic authentication to camera endpoints using empty password strings.
Correlate camera HTTP API traffic with subsequent outbound egress from the same device IP.

Monitoring Recommendations

Log all HTTP traffic to and from IoT camera VLANs and forward it to a centralized analytics platform.
Baseline normal camera API usage and alert on deviations, especially calls touching SetMAC or configuration endpoints.
Monitor for lateral movement attempts originating from camera IP addresses.

How to Mitigate CVE-2026-58453

Immediate Actions Required

Isolate JAIOTlink C492A-W6 cameras on a dedicated VLAN with no route to sensitive internal networks or the internet.
Block inbound access to TCP port 80 on affected cameras from all hosts except an administrative jump host.
If the camera exposes a password change function, set a strong administrator password and verify the empty password no longer authenticates.

Patch Information

No vendor patch is listed in the CVE record at time of publication. Consult the VulnCheck Advisory on Hard-Coded Credentials for the current vendor response status. Where no fix is available, treat affected devices as untrusted and consider replacement with a camera platform that enforces first-boot password provisioning.

Workarounds

Place cameras behind a firewall that restricts port 80 access to a defined management IP allowlist.
Disable remote access, port forwarding, and UPnP entries that expose the camera to the internet.
Route camera traffic through a reverse proxy that enforces its own authentication layer in front of anyka_ipc.
Where feasible, power down affected devices until a vendor firmware fix is available.

bash

# Example iptables rule to restrict camera HTTP access to a management host
iptables -A FORWARD -p tcp -d <camera_ip> --dport 80 -s <mgmt_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <camera_ip> --dport 80 -j DROP