CVE-2017-16566
CriticalSummary
On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, allowing remote attackers to read or replace core system files, including those used for authentication (such as passwd and shadow). This can be exploited to gain full root level control of the device.
Risk Assessment
The organization is at risk of losing control over devices, which may lead to data leakage or modification. Attackers could gain access to sensitive information and remotely manage the device.
Recommendation
It is recommended to secure the FTP server by requiring authentication and to regularly update the device firmware to the latest versions to minimize risk.
Original NVD description (English source)
On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, which allows remote attackers to read or replace core system files including those used for authentication (such as passwd and shadow). This can be abused to take full root level control of the device.