CVE-2026-2561: medium-severity vulnerability in JingDong JD Cloud Box AX6600
JingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi web_get_ddns_uptime privileges management
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.6%
exploitation probability
0.6%top 51% of all CVEs
observed exploitation
nono source reports it
A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdcapi of the component jdcweb_rpc. Performing a manipulation results in Remote Privilege Escalation. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
JingDong · JD Cloud Box AX6600Related CVEs — JingDong JD Cloud Box AX6600
In the same product, most dangerous first.
CVE-2026-2562MEDIUMJingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi cast_streen privileges managementEPSS 0.6%CVE-2026-2563MEDIUMJingDong JD Cloud Box AX6600 jdcapp_rpc controlDevice get_status privileges managementEPSS 0.6%CVE-2026-11413HIGHJingDong JD Cloud Box AX6600 jdcweb_rpc set_macfilter stack-based overflowEPSS 0.5%