Privilege escalation in Jdcloud Ax6600
CVE-2026-2563
A vulnerability was identified in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. Affected is the function set_stcreenen_deabled_status/get_status of the file /f/service/controlDevice of the component jdcapp_rpc. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
EPSS: 0.004 (35.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Jdcloud Ax6600
- Jdcloud Ax6600_firmware
- Jingdong Jd Cloud Box Ax6600 — versions 4.5.1.r4533
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, permissions-required, VDB Entry, Third Party Advisory)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (Permissions Required, Third Party Advisory, exploit)
Frequently asked questions
- What is CVE-2026-2563?
- CVE-2026-2563 is a medium-severity vulnerability in Jdcloud Ax6600, classified under Incorrect Privilege Assignment. CVSS score: 6.3/10. Published 2026-02-16.
- How severe is CVE-2026-2563?
- Medium severity. CVSS v3 base score is 6.3 out of 10.