Privilege escalation in Jdcloud Ax6600
CVE-2026-2561
A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdcapi of the component jdcweb_rpc. Performing a manipulation results in Remote Privilege Escalation. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
EPSS: 0.003 (24.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Jdcloud Ax6600
- Jdcloud Ax6600_firmware
- Jingdong Jd Cloud Box Ax6600 — versions 4.5.1.r4533
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, permissions-required, VDB Entry, Third Party Advisory)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (Permissions Required, Third Party Advisory, exploit)
Frequently asked questions
- What is CVE-2026-2561?
- CVE-2026-2561 is a medium-severity vulnerability in Jdcloud Ax6600, classified under Incorrect Privilege Assignment. CVSS score: 6.3/10. Published 2026-02-16.
- How severe is CVE-2026-2561?
- Medium severity. CVSS v3 base score is 6.3 out of 10.