Detection Guidance

There are no specific detection commands or methods provided for identifying this vulnerability on your network or system.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

No known countermeasures or patches exist for this vulnerability as the vendor did not respond or provide any mitigation.

It is suggested to replace the affected product with an alternative solution to mitigate the risk.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-2561 is a critical remote privilege escalation vulnerability found in JingDong JD Cloud Box AX6600 and JingDong Cloud NAS Router AX6600 firmware versions up to 4.5.1.r4533.

The flaw exists in the function web_get_ddns_uptime within the /jdcapi endpoint of the jdcweb_rpc component. An attacker can exploit this vulnerability remotely by sending manipulated input to this function, which lacks proper input validation and filtering.

This allows the attacker to execute arbitrary commands remotely on the device, leading to unauthorized privilege escalation without requiring physical or local access.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to unauthorized privilege escalation on the affected device, compromising its confidentiality, integrity, and availability.

An attacker can remotely execute arbitrary commands, potentially gaining control over the device and its functions.

Since the exploit is publicly available and easy to perform, affected systems are at high risk if not mitigated.

No known countermeasures or patches exist, so the recommended action is to replace the affected product with an alternative solution.

Useful 0 Not Useful 0