CVE-2026-2563
📋 TL;DR
A remote privilege escalation vulnerability in JingDong JD Cloud Box AX6600 allows attackers to gain elevated privileges by manipulating the set_stcreenen_deabled_status/get_status functions. This affects devices running firmware up to version 4.5.1.r4533. The vulnerability is remotely exploitable and public exploit code exists.
💻 Affected Systems
- JingDong JD Cloud Box AX6600
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to execute arbitrary code, access sensitive data, and maintain persistent access.
Likely Case
Attackers gain administrative control over the device to modify configurations, intercept traffic, or use as a pivot point for further attacks.
If Mitigated
Limited impact if device is isolated from untrusted networks and proper access controls are implemented.
🎯 Exploit Status
Exploit is publicly available and the vendor has not responded to disclosure, suggesting active exploitation is probable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Monitor vendor channels for firmware updates beyond version 4.5.1.r4533.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices from untrusted networks and restrict access to management interfaces.
Access Control Lists
allImplement firewall rules to restrict access to the vulnerable endpoint (/f/service/controlDevice).
🧯 If You Can't Patch
- Remove affected devices from production networks or place them in isolated VLANs
- Implement strict network monitoring for unusual traffic patterns to/from affected devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version via device web interface or SSH if available. Vulnerable if version is ≤ 4.5.1.r4533.Check Version:
Check device web interface or use vendor-specific CLI commands if available.Verify Fix Applied:
Verify firmware version is updated beyond 4.5.1.r4533 when vendor releases patch.📡 Detection & Monitoring
Log Indicators:
- Unusual access to /f/service/controlDevice endpoint
- Privilege escalation attempts in system logs
Network Indicators:
- Unexpected network traffic to device management ports
- Exploit-specific patterns to vulnerable endpoint
SIEM Query:
Search for network connections to port associated with /f/service/controlDevice from untrusted sources.