CVE-2026-56718CWE-22path-traversal

CVE-2026-56718

High · published August 31, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
60.7
In the wild
Unconfirmed
What it is

AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00944 · 60.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-31T01:16Z
References (3)
https://hellkid.dev/writeups/cve-2026-56718/ · [email protected]https://www.ajcloud.net/ · [email protected]https://www.vulncheck.com/advisories/ajcloud-ajy-ipc-firmware-path-traversal-via-jdbhttpd · [email protected]
EPSS history
Timeline
  • 01 SEP 03:31Z
    EPSS moved — → 1%
    epss
  • 30 AUG 20:13Z
    AJCloud AJY IPC Firmware Path Traversal via jdbhttpd
    cvelistv5