CVE-2026-2561
📋 TL;DR
This vulnerability allows remote attackers to escalate privileges on JingDong JD Cloud Box AX6600 devices by exploiting a flaw in the web_get_ddns_uptime function. Attackers can gain elevated access without authentication by sending specially crafted requests to the /jdcapi endpoint. All users of affected devices are at risk until patched.
💻 Affected Systems
- JingDong JD Cloud Box AX6600
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install malware, steal credentials, pivot to internal networks, or render the device unusable.
Likely Case
Attackers gain administrative control over the device to modify configurations, intercept network traffic, or use it as a foothold for further attacks.
If Mitigated
Limited impact if devices are isolated in separate network segments with strict firewall rules blocking external access to management interfaces.
🎯 Exploit Status
The exploit has been made public according to the disclosure, making it accessible to attackers with basic technical skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Monitor vendor channels for updates. If a patch becomes available, download from official sources and apply following vendor instructions.
🔧 Temporary Workarounds
Disable Remote Management
allDisable the jdcweb_rpc component or block access to the /jdcapi endpoint to prevent exploitation.
Check device web interface for remote management settings and disable if possible
Network Segmentation
allIsolate affected devices in a separate VLAN with strict firewall rules.
Configure firewall to block external access to device management ports (typically 80, 443, 8080)
🧯 If You Can't Patch
- Immediately isolate affected devices from internet access and place behind strict firewall rules
- Implement network monitoring for suspicious traffic to/from device management interfaces
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or SSH if available. Versions up to 4.5.1.r4533 are vulnerable.Check Version:
Check web interface System Status or use: cat /etc/version (if SSH access available)Verify Fix Applied:
Verify firmware version is above 4.5.1.r4533 when patch becomes available. Test that /jdcapi endpoint no longer accepts malicious requests.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /jdcapi endpoint
- Multiple failed authentication attempts followed by successful privileged access
- Changes to system configuration from unexpected sources
Network Indicators:
- Unusual outbound connections from device after exploitation
- Traffic patterns suggesting privilege escalation attempts
SIEM Query:
source_ip="device_ip" AND (uri_path="/jdcapi" OR user_agent_contains="exploit")