Andres Valdes

**Name of the Vulnerable Software and Affected Versions** JAIOTlink C492A-W6 version 4.8.30.57701411 **Description** An OS command injection flaw exists where authenticated attackers can achieve remote code execution. By sending a malicious string to the 'NetSDK/Factory SetMAC' HTTP PUT endpoint, an attacker can bypass partial `sscanf()` validation. The attack involves providing a `Wireless` parameter starting with a valid MAC-like prefix followed by a semicolon and a shell payload, which is then passed unsanitized into an `echo` shell command executed via a `system()` wrapper. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `Wireless` parameter in the 'NetSDK/Factory SetMAC' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** JAIOTlink C492A-W6 Wi-Fi IP camera version 4.8.30.57701411 **Description** The anyka ipc HTTP service on port 80 accepts a default admin username with an empty password. This allows network-adjacent attackers to gain unauthorized access to camera snapshots, video streams, and network configuration. Additionally, attackers can access factory-level API endpoints, including the `SetMAC` command injection surface, which allows the execution of arbitrary commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** JAIOTlink C492A-W6 version 4.8.30.57701411 **Description** Authenticated attackers can achieve persistent remote code execution by writing arbitrary shell scripts to the writable persistent JFFS2 storage path. The execution is triggered through an authenticated HTTP endpoint that invokes the script via the `popen()` function. This allows the malicious script to persist even after the device is rebooted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.