PT-2026-8353 · Jingdong · Jd Cloud Box Ax6600

Shiyufan_Binyuan · Published 2026-02-16 · Updated 2026-02-16 · CVE-2026-2562

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JingDong JD Cloud Box AX6600 versions through 4.5.1.r4533

Description A flaw exists in JingDong JD Cloud Box AX6600. The issue is related to the cast streen function within the jdcweb rpc component, specifically in the file /jdcapi. Manipulation of the File argument can lead to Remote Privilege Escalation. The attack can be carried out remotely. The exploit for this issue has been publicly disclosed.

Recommendations Versions prior to 4.5.1.r4533 should be updated.

Exploit

Fix

Improper Privilege Management

Incorrect Privilege Assignment

Weakness Enumeration

CWE-269

CWE-266

Related Identifiers

CVE-2026-2562

Affected Products

Jd Cloud Box Ax6600

References · 6

• 🔥 https://my.feishu.cn/wiki/Umb6w4PasizunKkagYschZP1nff · Exploit
• https://osv.dev/vulnerability/CVE-2026-2562 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2562 · Security Note
• https://vuldb.com/?ctiid.346169 · Note
• https://vuldb.com/?submit.750986 · Note
• https://vuldb.com/?id.346169 · Note