CVE-2026-11413: JD Cloud Box Buffer Overflow Vulnerability

CVE-2026-11413 Overview

CVE-2026-11413 is a stack-based buffer overflow vulnerability in the JingDong JD Cloud Box AX6600 router running firmware version 4.5.3.r4546. The flaw resides in the set_macfilter function within the /sbin/jdcweb_rpc binary. An authenticated remote attacker can manipulate input passed to this function to corrupt the stack and influence program execution.

The exploit has been disclosed publicly, increasing the likelihood of opportunistic use against exposed devices. According to the disclosure, the vendor was contacted prior to publication but did not respond. The vulnerability is tracked under CWE-119 for improper restriction of operations within memory buffer bounds.

Critical Impact
Remote attackers with low privileges can trigger a stack-based buffer overflow in the router's RPC service, leading to memory corruption with high impact to confidentiality, integrity, and availability of the device.

Affected Products

JingDong JD Cloud Box AX6600 router
Firmware version 4.5.3.r4546
/sbin/jdcweb_rpc binary, set_macfilter function

Discovery Timeline

2026-06-06 - CVE-2026-11413 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11413

Vulnerability Analysis

The vulnerability exists in the set_macfilter function of the /sbin/jdcweb_rpc daemon, which handles remote procedure calls for the device's web management interface. The function processes MAC filter configuration data without enforcing proper bounds on user-supplied input. Attacker-controlled data is copied to a fixed-size stack buffer, overwriting adjacent stack memory including saved return addresses.

The issue maps to CWE-119, improper restriction of operations within the bounds of a memory buffer. Successful exploitation can corrupt control flow, crash the RPC service, or, depending on memory protections present on the embedded MIPS or ARM target, lead to arbitrary code execution in the context of the router service.

The EPSS score is 0.043% (percentile 13.688), reflecting limited observed exploitation activity at the time of publication. However, public availability of a proof-of-concept archive raises the practical risk.

Root Cause

The root cause is the absence of length validation on parameters passed to set_macfilter. The function likely uses unbounded copy operations such as strcpy or sprintf against a stack-allocated buffer. Embedded router binaries frequently lack stack canaries, ASLR, and non-executable stacks, which makes such overflows directly weaponizable.

Attack Vector

The attack vector is network-based and requires low privileges, consistent with an authenticated user invoking the RPC endpoint. An attacker reachable over the LAN, or over the WAN if remote management is enabled, can issue a crafted RPC request to jdcweb_rpc with an oversized MAC filter value. A publicly hosted exploit archive, referenced as JDCloud Overflow Exploit, demonstrates the technique. Additional technical detail is available at VulDB CVE-2026-11413.

No verified code examples are available. See the referenced advisories for proof-of-concept material.

Detection Methods for CVE-2026-11413

Indicators of Compromise

Unexpected crashes or restarts of the jdcweb_rpc process on the AX6600 device
Inbound RPC requests targeting MAC filter configuration endpoints with abnormally long parameter values
New or unexpected administrative sessions to the router web interface preceding service instability
Outbound connections from the router to unknown hosts following configuration changes

Detection Strategies

Inspect router system logs for repeated jdcweb_rpc segmentation faults or watchdog-triggered reboots
Monitor HTTP/HTTPS traffic to the device administration interface for payloads exceeding expected field lengths in MAC filter parameters
Apply network intrusion detection rules that flag oversized values within JD Cloud Box RPC endpoints
Audit firmware integrity and configuration baselines on affected devices to detect unauthorized modification

Monitoring Recommendations

Collect syslog from the router to a central log store and alert on RPC service termination events
Restrict management plane traffic to a dedicated administrative VLAN and monitor that segment for anomalies
Track authentication events to the router web UI and correlate with subsequent service failures
Enable NetFlow or equivalent telemetry on upstream switches to identify lateral movement attempts following device compromise

How to Mitigate CVE-2026-11413

Immediate Actions Required

Disable remote (WAN-side) management on the JD Cloud Box AX6600 to remove internet-facing exposure
Change all administrative credentials and audit user accounts on the device
Segment the router away from sensitive internal networks until a fix is available
Monitor VulDB Vulnerability #368970 for vendor patch announcements

Patch Information

No vendor patch is available at the time of publication. According to the disclosure, JingDong did not respond to coordinated disclosure attempts. Affected users should track VulDB CVE-2026-11413 and the JD Cloud product portal for firmware updates superseding 4.5.3.r4546.

Workarounds

Block access to the router management interface from untrusted networks using upstream firewall rules
Disable the MAC filter feature if it is not required, reducing the reachability of the vulnerable set_macfilter handler
Restrict administrative access to a limited set of source IP addresses on the LAN
Consider replacing the device with a vendor-supported alternative if a patch is not issued in a reasonable timeframe

bash

# Example: restrict router management interface access at an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP