CVE-2026-2561
Published: 16 February 2026
Description
A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdcapi of the component jdcweb_rpc. Performing a manipulation results in Remote Privilege Escalation. The attack is possible to be…
more
carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Mitigating Controls (NIST 800-53 r5)AI
Enforces least privilege to limit the impact of privilege escalation vulnerabilities like CVE-2026-2561 by restricting processes to minimal necessary access rights.
Validates inputs to the vulnerable web_get_ddns_uptime function to block manipulations that enable remote privilege escalation in CVE-2026-2561.
Directly remediates the publicly exploited flaw in CVE-2026-2561 through timely patching or mitigation of the jdcweb_rpc component.
Security SummaryAI
CVE-2026-2561 is a remote privilege escalation vulnerability in JingDong JD Cloud Box AX6600 firmware versions up to 4.5.1.r4533. The issue resides in the web_get_ddns_uptime function within the /jdcapi file of the jdcweb_rpc component. Manipulation of this function enables attackers to escalate privileges remotely.
Attackers with low privileges (PR:L) can exploit the vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), without changing scope (S:U). Successful exploitation grants limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), yielding a CVSS v3.1 base score of 6.3. The exploit has been made public and is usable remotely. Associated weaknesses include CWE-266 and CWE-269.
Advisories from VulDB indicate the vendor was contacted early about the disclosure but provided no response, with no patches or mitigations detailed. Relevant references include https://vuldb.com/?ctiid.346168, https://vuldb.com/?id.346168, https://vuldb.com/?submit.750977, and https://my.feishu.cn/wiki/URLywnBj2i2dpBk3dcQcWqFZnSK.
The public availability of the exploit heightens risk for unpatched JD Cloud Box AX6600 devices.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-2561 is explicitly a remote privilege escalation vulnerability (CWE-266, CWE-269), directly enabling T1068: Exploitation for Privilege Escalation.