Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H N N 8.7 .0094 59.7 —
AFFECTED Product Versions Fixed AJY IPC Firmware unspecified —
TIMELINE Jun 22 Reserved by VulnCheck Aug 30 Published (CNA: VulnCheck) Sep 4 EXPLOIT PUBLISHED — CVE-2026-56718 (AJCloud AJY IPC Firmware). Public exploit reference added.
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.
| Date | Event | Detail |
|---|---|---|
| June 22, 2026 | Reserved | Reserved by VulnCheck |
| August 30, 2026 | Published | Published (CNA: VulnCheck) |
| September 4, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-56718 (AJCloud AJY IPC Firmware). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| AJCloud | AJY IPC Firmware | — | — | — |
Authoritative record: CVE-2026-56718 at cve.org
Vendors: ajcloud
Weaknesses: CWE-22
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-56718 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
