CVE-2026-56718 AJCloud AJY IPC Firmware Path Traversal via jdbhttpd
Unauthenticated attackers can read arbitrary files with root privileges via path traversal in the web service, exposing sensitive credentials and configuration data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56718?
CVE-2026-56718 is a high-severity path traversal vulnerability in AJCloud AJY IPC Firmware, published on 30 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.
Weakness: CWE-22
Which versions are affected by CVE-2026-56718?
How do I fix CVE-2026-56718?
No fix has been published for CVE-2026-56718 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-56718 being exploited?
There is no known exploitation of CVE-2026-56718 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-wh46-v79m-w9cq.