CVE-2026-110109

Deferred Deferred - Pending Action

JetLinks Community Missing Authorization in Transparent Codec

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110109

EUVD

EUVD-2026-98942

Affected Vendors & Products

Vendor	Product	Version / Range
jetlinks	JetLinks	Community 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JetLinks Community through 2.10.0 has a missing authorization flaw in the transparent-codec feature. Users with only query access can exploit POST /device/transparent-codec/{productId} to overwrite product codecs. The endpoint lacks @SaveAction, enabling attackers to save arbitrary codec providers and configurations. This allows control over how transparent messages are decoded and encoded for all devices of a targeted product.

Detection Guidance

Check for unauthorized POST requests to /device/transparent-codec/{productId} with parameters that modify codec providers or configurations. Monitor logs for unexpected changes to product codecs or transparent message handling.

Impact Analysis

An attacker could manipulate device communication by altering codec configurations, potentially leading to unauthorized data access, message interception, or device manipulation. This could disrupt operations or expose sensitive information processed by affected devices.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access or data breaches, which are critical violations under GDPR and HIPAA. Organizations using JetLinks may face legal penalties, reputational damage, and loss of certification if data integrity is compromised.

Mitigation Strategies

Apply the latest patch from JetLinks to version 2.10.0 or later. Restrict access to the /device/transparent-codec/{productId} endpoint to authorized users only. Review and audit codec configurations for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-110109. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70