Executive Summary

CVE-2026-2563 is a remote privilege escalation vulnerability affecting the JingDong JD Cloud Box AX6600 devices running firmware up to version 4.5.1.r4533. The flaw exists in the jdcapp_rpc component, specifically in the functions set_stcreenen_deabled_status and get_status within the /f/service/controlDevice file.

The vulnerability arises because these functions improperly handle user-supplied parameters without adequate validation or filtering, allowing an attacker to remotely execute arbitrary commands by manipulating these inputs. This leads to unauthorized privilege escalation on the device.

The exploit is publicly available and considered easy to execute remotely. Despite early notification, the vendor did not respond or provide mitigation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to remotely execute arbitrary commands on the affected device, leading to privilege escalation without local access.

As a result, the attacker can compromise the confidentiality, integrity, and availability of the device and potentially the network it is connected to.

Since the exploit is publicly available and easy to execute, the risk of unauthorized access and control over the device is significant.

No known countermeasures or vendor patches exist, so affected users should consider replacing the device to mitigate the risk.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves remote command execution through the functions set_stcreenen_deabled_status/get_status in the /f/service/controlDevice component of the JingDong JD Cloud Box AX6600. Detection would involve monitoring for unusual or unauthorized remote calls to these interfaces.

Since the exploit involves sending crafted inputs to these functions to execute arbitrary commands, detection could include inspecting network traffic for suspicious requests targeting these endpoints.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

There are no known countermeasures or vendor-provided patches available for this vulnerability as the vendor did not respond to the disclosure.

Immediate mitigation steps include considering replacing the affected product to avoid exploitation.

Monitoring for suspicious activity and restricting remote access to the affected device may help reduce risk temporarily.

Useful 0 Not Useful 0