CVE-2026-2561
Remote Privilege Escalation in JingDong JD Cloud Box AX
Publication date: 2026-02-16
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jdcloud | ax6600_firmware | to 4.5.1.r4533 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or methods provided for identifying this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or patches exist for this vulnerability as the vendor did not respond or provide any mitigation.
It is suggested to replace the affected product with an alternative solution to mitigate the risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
CVE-2026-2561 is a critical remote privilege escalation vulnerability found in JingDong JD Cloud Box AX6600 and JingDong Cloud NAS Router AX6600 firmware versions up to 4.5.1.r4533.
The flaw exists in the function web_get_ddns_uptime within the /jdcapi endpoint of the jdcweb_rpc component. An attacker can exploit this vulnerability remotely by sending manipulated input to this function, which lacks proper input validation and filtering.
This allows the attacker to execute arbitrary commands remotely on the device, leading to unauthorized privilege escalation without requiring physical or local access.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to unauthorized privilege escalation on the affected device, compromising its confidentiality, integrity, and availability.
An attacker can remotely execute arbitrary commands, potentially gaining control over the device and its functions.
Since the exploit is publicly available and easy to perform, affected systems are at high risk if not mitigated.
No known countermeasures or patches exist, so the recommended action is to replace the affected product with an alternative solution.