CVE-2026-2561: Jdcloud Ax6600 Privilege Escalation Flaw

CVE-2026-2561 Overview

A remote privilege escalation vulnerability has been discovered in JingDong JD Cloud Box AX6600 router firmware up to version 4.5.1.r4533. This vulnerability affects the web_get_ddns_uptime function within the /jdcapi file of the jdcweb_rpc component. Successful exploitation allows attackers to escalate privileges remotely on the affected device.

Critical Impact

Remote attackers with low-level privileges can exploit this vulnerability to escalate their privileges on vulnerable JD Cloud Box AX6600 devices, potentially gaining unauthorized control over network infrastructure.

Affected Products

• JD Cloud AX6600 Firmware up to version 4.5.1.r4533
• JD Cloud AX6600 Hardware Device
• JD Cloud Box AX6600 Router (all firmware versions through 4.5.1.r4533)

Discovery Timeline

• 2026-02-16 - CVE-2026-2561 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-2561

Vulnerability Analysis

This vulnerability is classified under CWE-269 (Improper Privilege Management), indicating a fundamental flaw in how the affected component handles privilege boundaries. The web_get_ddns_uptime function within the jdcweb_rpc component fails to properly validate or restrict privilege-sensitive operations, allowing low-privileged users to perform actions that should require elevated permissions.

The vulnerability exists in the /jdcapi endpoint, which is part of the device's web management interface. The exploit details have been publicly disclosed, and the vendor (JingDong) was contacted but did not respond to the disclosure.

Root Cause

The root cause of CVE-2026-2561 lies in improper privilege management within the web_get_ddns_uptime function. The function does not adequately verify the authorization level of incoming requests before executing privileged operations. This allows authenticated users with minimal privileges to manipulate requests and access functionality intended only for administrative users.

The vulnerability stems from insufficient access control checks in the jdcweb_rpc component, where the authentication state is not properly correlated with the required permission level for DDNS-related operations.

Attack Vector

The attack can be executed remotely over the network, requiring only low-level authentication to the device's web interface. An attacker who has obtained basic user credentials or session access can craft malicious requests to the /jdcapi endpoint targeting the web_get_ddns_uptime function.

The exploitation process involves:

1. Authenticating to the JD Cloud Box AX6600 with a low-privileged account
2. Sending crafted requests to the /jdcapi endpoint
3. Manipulating the web_get_ddns_uptime function to execute privileged operations
4. Escalating privileges to gain administrative control over the device

Technical details regarding the specific manipulation technique are available in the Feishu Documentation linked in the security references. Additional vulnerability tracking information is available through the VulDB entry #346168.

Detection Methods for CVE-2026-2561

Indicators of Compromise

• Unusual HTTP requests targeting the /jdcapi endpoint from authenticated low-privilege sessions
• Anomalous calls to web_get_ddns_uptime function with unexpected parameters
• Privilege elevation events in device logs without corresponding administrative authentication
• Configuration changes on the AX6600 device that were not initiated by administrators

Detection Strategies

• Monitor network traffic for HTTP POST requests to /jdcapi with suspicious payloads
• Implement log analysis rules to detect privilege escalation attempts on JD Cloud devices
• Deploy intrusion detection signatures targeting malformed or manipulated DDNS-related requests
• Review authentication logs for sessions that transition from low-privilege to high-privilege operations

Monitoring Recommendations

• Enable verbose logging on the JD Cloud Box AX6600 web management interface
• Configure SIEM alerts for anomalous activity patterns on the /jdcapi endpoint
• Establish baseline behavior for legitimate DDNS operations to identify deviations
• Monitor for any new administrative accounts or configuration changes on affected devices

How to Mitigate CVE-2026-2561

Immediate Actions Required

• Restrict network access to the JD Cloud Box AX6600 web management interface to trusted IP addresses only
• Disable or limit access to the /jdcapi endpoint if DDNS functionality is not required
• Implement network segmentation to isolate vulnerable router devices from critical network segments
• Review and audit all user accounts on affected devices, removing unnecessary low-privilege accounts

Patch Information

As of the last modification date (2026-02-19), the vendor (JingDong) has not responded to the vulnerability disclosure and no official patch has been released. Organizations using affected JD Cloud Box AX6600 devices should apply the workarounds listed below and monitor for vendor updates.

Additional technical information and tracking can be found through the VulDB CTI entry and the VulDB submission #750977.

Workarounds

• Restrict access to the router's web management interface to internal management networks only
• Implement firewall rules to block external access to port 80/443 on affected devices
• Use VPN or jump host access for remote administration rather than exposing the web interface
• Consider replacing affected devices with alternative router hardware until a patch is available

# Example firewall rule to restrict access to management interface
# Block external access to the router's web interface
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP

# Allow only specific management IP addresses
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.100 -j ACCEPT