CVE-2026-2562: Jdcloud Ax6600 Privilege Escalation Flaw

CVE-2026-2562 Overview

A remote privilege escalation vulnerability has been identified in JingDong JD Cloud Box AX6600 routers running firmware versions up to 4.5.1.r4533. The vulnerability exists in the cast_streen function within the /jdcapi file of the jdcweb_rpc component. An authenticated attacker can exploit this flaw by manipulating the File argument, potentially gaining elevated privileges on the affected device.

Critical Impact

Remote attackers with low privileges can escalate their access on vulnerable JD Cloud Box AX6600 devices through the jdcweb_rpc component, potentially compromising network infrastructure security.

Affected Products

• JD Cloud AX6600 Firmware versions up to 4.5.1.r4533
• JD Cloud AX6600 Hardware Device

Discovery Timeline

• 2026-02-16 - CVE-2026-2562 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-2562

Vulnerability Analysis

This vulnerability represents a privilege escalation issue classified under CWE-269 (Improper Privilege Management). The affected cast_streen function in the /jdcapi endpoint fails to properly validate or restrict privileges when processing the File argument. This improper privilege management allows authenticated users with limited access to perform operations that should be restricted to higher-privileged accounts.

The network-accessible nature of this vulnerability means that any attacker who can reach the device's web interface and has basic authentication credentials can potentially exploit this flaw to escalate their privileges on the router.

Root Cause

The root cause stems from improper privilege management (CWE-269) in the jdcweb_rpc component. The cast_streen function does not adequately verify the caller's privilege level before processing file-related operations, allowing low-privileged users to perform administrative actions through the manipulation of the File parameter.

Attack Vector

The attack is network-based and can be executed remotely against vulnerable JD Cloud Box AX6600 devices. An attacker requires low-level privileges (basic authentication) but no user interaction is needed to exploit the vulnerability. The exploitation flow involves:

1. Establishing a network connection to the target device
2. Authenticating with low-privilege credentials
3. Sending a crafted request to the /jdcapi endpoint
4. Manipulating the File argument in the cast_streen function call
5. Achieving privilege escalation on the device

The exploit has been publicly disclosed according to the vulnerability advisory. Technical details can be found in the Feishu Wiki Resource and VulDB entry #346169.

Detection Methods for CVE-2026-2562

Indicators of Compromise

• Unusual HTTP requests targeting the /jdcapi endpoint on JD Cloud AX6600 devices
• Anomalous File parameter values in requests to the cast_streen function
• Unexpected privilege changes or administrative activities from low-privileged user sessions
• Authentication logs showing privilege escalation attempts from network sources

Detection Strategies

• Monitor network traffic for suspicious requests to /jdcapi endpoints on affected devices
• Implement web application firewall (WAF) rules to detect manipulation attempts targeting the File parameter
• Review device access logs for privilege escalation patterns and unauthorized administrative operations
• Deploy network-based intrusion detection signatures for known exploitation patterns

Monitoring Recommendations

• Enable verbose logging on JD Cloud Box AX6600 devices if available
• Set up alerts for any modifications to user privilege levels on network devices
• Monitor for lateral movement attempts originating from compromised router devices
• Implement network segmentation to limit the blast radius of a compromised network appliance

How to Mitigate CVE-2026-2562

Immediate Actions Required

• Identify all JD Cloud Box AX6600 devices in your environment running firmware versions up to 4.5.1.r4533
• Restrict network access to the device management interface using firewall rules or VLANs
• Disable remote management interfaces where possible until a patch is available
• Implement strong authentication controls and review existing user accounts for unnecessary privileges
• Monitor affected devices for signs of exploitation

Patch Information

As of the last update, the vendor (JingDong/JD Cloud) was contacted about this disclosure but did not respond. No official patch information is currently available. Organizations should monitor the VulDB entry for updates regarding vendor response or patch releases.

Workarounds

• Restrict management interface access to trusted networks only using ACLs or firewall rules
• Implement network segmentation to isolate affected devices from critical network segments
• Disable the jdcweb_rpc component if functionality permits (may affect device features)
• Use a VPN for remote administration rather than exposing the management interface directly
• Consider replacing vulnerable devices with alternatives if no patch becomes available

# Example: Restrict access to management interface (firewall rule)
# Block external access to the device management port
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP