CVE-2026-56718— AJCloud AJY IPC Firmware Path Traversal via jdbhttpd
Quick assessment
Affected
AJCloud AJY IPC Firmware
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AJCloud AJY IPC 系列摄像头固件在版本 01.10715.11.37 之前的版本中，其 Web 服务存在路径遍历（Path Traversal）漏洞。未经身份验证的远程攻击者可以通过在 HTTP 请求 URI 中提供路径遍历序列（如 等），以 root 权限读取系统中的任意文件。攻击者可以向端口 80 发送构造好的 HTTP 请求，且无需进行身份验证，即可访问敏感文件，这些文件包括明文存储的 RTSP 认证凭据、Wi-Fi SSID 及预共享密钥（PSK）、设备序列号，以及云端绑定参数等。
Possible ATT&CK Techniques 1 AI
T1212.002
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-56718
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AJCloud AJY IPC Firmware Path Traversal via jdbhttpd
Source: CVE Program / CVE List V5
Vulnerability Description
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AJCloud | AJY IPC Firmware | 0 ~ 01.10715.11.37 | - |
|
II. Public POCs for CVE-2026-56718
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56718
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56718 (1)
-
🔗 AJCloud AJY IPC Firmware Path Traversal via jdbhttpd | Advisories | VulnCheck third-party-advisory
Vendor Pages for CVE-2026-56718 (1)
-
🔗 AJCLOUD product
IV. Related Vulnerabilities
Same weakness: CWE-22
-
CVE-2026-82656
Admidio before 5.0.12 Path Traversal via Photo ZIP Download -
CVE-2026-82635
Pake arbitrary file write via unsanitized download_file file -
CVE-2026-82460
Cloud Commander before 19.20.2 Directory Traversal via REST -
CVE-2026-18899
Langflow is affected by multiple authentication bypass, path -
CVE-2026-55552
Yamcs: Unauthenticated Directory Traversal
V. Comments for CVE-2026-56718
No comments yet