CVE-2026-2561: JingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi web_get_ddns_uptime privileges management

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-16 · updated 2026-06-17
Weakness: CWE-266

Description

A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdcapi of the component jdcweb_rpc. Performing a manipulation results in Remote Privilege Escalation. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

JingDong JD Cloud Box AX6600: through 4.5.1.r4533

References

https://my.feishu.cn/wiki/URLywnBj2i2dpBk3dcQcWqFZnSK
https://vuldb.com/?ctiid.346168
https://vuldb.com/?id.346168
https://vuldb.com/?submit.750977

Get alerted when CVE-2026-2561 or the next vulnerability affects your stack