An unauthenticated path traversal vulnerability in AJCloud AJY IPC firmware allows remote attackers to exfiltrate sensitive device credentials and configuration data with root-level access.

This is a path traversal vulnerability (CWE-22) residing in the jdbhttpd web service. Unauthenticated remote attackers can exploit this by injecting traversal sequences into the HTTP request URI to access sensitive files on the underlying filesystem.

The ability for an unauthenticated attacker to read arbitrary files as the root user poses a severe risk to organizational security. Compromised data includes RTSP credentials, Wi-Fi keys, and cloud binding parameters, which can lead to unauthorized camera access, network infiltration, or takeover of cloud-connected assets. Given the CVSS score of 7.5, this high-severity vulnerability requires immediate attention to prevent full device compromise.

Immediate Action: Update the AJY IPC firmware to version 01.10715.11.37 or higher immediately to close the vulnerable path traversal vector.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal patterns, such as sequences of dots and slashes, directed at the jdbhttpd service.

Compensating Controls: Deploy a Web Application Firewall or network access control list to restrict access to the device management interface to trusted internal IP addresses only.

Public Exploit Available: No

This vulnerability represents a significant security failure due to the exposure of sensitive credentials via an unauthenticated interface. Administrators must prioritize updating all affected AJCloud cameras to the patched firmware version. Until updates can be applied, ensure that these devices are isolated from the public internet to mitigate the risk of remote exploitation.