CVE-2026-56718: AJCloud AJY IPC Firmware Path Traversal via jdbhttpd
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AJCloud AJY IPC firmwareto a version that resolves this vulnerability.Fixed in 01.10715.11.37 - Compensating control
Block or restrict unauthenticated access to port 80 (the jdbhttpd web service) so remote attackers cannot send crafted HTTP requests to exploit the path traversal vulnerability.
Event History
Frequently Asked Questions
Which devices are exposed to this issue?
AJCloud AJY IPC devices running firmware earlier than 01.10715.11.37 are affected if their jdbhttpd web service on port 80 is reachable by an attacker.
Does exploitation require authentication or user interaction?
No. An unauthenticated remote attacker can send a crafted HTTP request URI containing path traversal sequences to port 80; no user interaction is required.
What information could an attacker obtain?
The flaw permits reading arbitrary files with root privileges. Reported sensitive data includes cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.
How can exposure be reduced before updating firmware?
Restrict access to the device's HTTP service on port 80 so untrusted networks and remote attackers cannot reach it. The provided information identifies port 80 as the exploitation path.