CVE-2026-56718

HIGH 7.5

AJCloud AJY IPC Firmware Path Traversal via jdbhttpd

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.

CWE	CWE-22
Vendor	ajcloud
Product	ajy ipc firmware
Published	Aug 30, 2026

Stay Ahead of the Next One

Get instant alerts for ajcloud ajy ipc firmware

Be the first to know when new high vulnerabilities affecting ajcloud ajy ipc firmware are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

AJCloud / AJY IPC Firmware

0 < 01.10715.11.37

References

NVD ↗ CVE.org ↗ EPSS Data ↗

ajcloud.net: https://www.ajcloud.net/ vulncheck.com: https://www.vulncheck.com/advisories/ajcloud-ajy-ipc-firmware-path-traversal-via-jdbhttpd

Credits

Alessandro Ciotti VulnCheck