CVE-2026-2562: Jdcloud Ax6600 Privilege Escalation Flaw

CVE-2026-2562 Overview

A remote privilege escalation vulnerability has been identified in JingDong JD Cloud Box AX6600 routers running firmware versions up to 4.5.1.r4533. The vulnerability exists in the cast_streen function within the /jdcapi file of the jdcweb_rpc component. An authenticated attacker can exploit this flaw by manipulating the File argument, potentially gaining elevated privileges on the affected device.

Critical Impact
Remote attackers with low privileges can escalate their access on vulnerable JD Cloud Box AX6600 devices through the jdcweb_rpc component, potentially compromising network infrastructure security.

Affected Products

JD Cloud AX6600 Firmware versions up to 4.5.1.r4533
JD Cloud AX6600 Hardware Device

Discovery Timeline

2026-02-16 - CVE-2026-2562 published to NVD
2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-2562

Vulnerability Analysis

This vulnerability represents a privilege escalation issue classified under CWE-269 (Improper Privilege Management). The affected cast_streen function in the /jdcapi endpoint fails to properly validate or restrict privileges when processing the File argument. This improper privilege management allows authenticated users with limited access to perform operations that should be restricted to higher-privileged accounts.

The network-accessible nature of this vulnerability means that any attacker who can reach the device's web interface and has basic authentication credentials can potentially exploit this flaw to escalate their privileges on the router.

Root Cause

The root cause stems from improper privilege management (CWE-269) in the jdcweb_rpc component. The cast_streen function does not adequately verify the caller's privilege level before processing file-related operations, allowing low-privileged users to perform administrative actions through the manipulation of the File parameter.

Attack Vector

The attack is network-based and can be executed remotely against vulnerable JD Cloud Box AX6600 devices. An attacker requires low-level privileges (basic authentication) but no user interaction is needed to exploit the vulnerability. The exploitation flow involves:

Establishing a network connection to the target device
Authenticating with low-privilege credentials
Sending a crafted request to the /jdcapi endpoint
Manipulating the File argument in the cast_streen function call
Achieving privilege escalation on the device

The exploit has been publicly disclosed according to the vulnerability advisory. Technical details can be found in the Feishu Wiki Resource and VulDB entry #346169.

Detection Methods for CVE-2026-2562

Indicators of Compromise

Unusual HTTP requests targeting the /jdcapi endpoint on JD Cloud AX6600 devices
Anomalous File parameter values in requests to the cast_streen function
Unexpected privilege changes or administrative activities from low-privileged user sessions
Authentication logs showing privilege escalation attempts from network sources

Detection Strategies

Monitor network traffic for suspicious requests to /jdcapi endpoints on affected devices
Implement web application firewall (WAF) rules to detect manipulation attempts targeting the File parameter
Review device access logs for privilege escalation patterns and unauthorized administrative operations
Deploy network-based intrusion detection signatures for known exploitation patterns

Monitoring Recommendations

Enable verbose logging on JD Cloud Box AX6600 devices if available
Set up alerts for any modifications to user privilege levels on network devices
Monitor for lateral movement attempts originating from compromised router devices
Implement network segmentation to limit the blast radius of a compromised network appliance

How to Mitigate CVE-2026-2562

Immediate Actions Required

Identify all JD Cloud Box AX6600 devices in your environment running firmware versions up to 4.5.1.r4533
Restrict network access to the device management interface using firewall rules or VLANs
Disable remote management interfaces where possible until a patch is available
Implement strong authentication controls and review existing user accounts for unnecessary privileges
Monitor affected devices for signs of exploitation

Patch Information

As of the last update, the vendor (JingDong/JD Cloud) was contacted about this disclosure but did not respond. No official patch information is currently available. Organizations should monitor the VulDB entry for updates regarding vendor response or patch releases.

Workarounds

Restrict management interface access to trusted networks only using ACLs or firewall rules
Implement network segmentation to isolate affected devices from critical network segments
Disable the jdcweb_rpc component if functionality permits (may affect device features)
Use a VPN for remote administration rather than exposing the management interface directly
Consider replacing vulnerable devices with alternatives if no patch becomes available

bash

# Example: Restrict access to management interface (firewall rule)
# Block external access to the device management port
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP