Vulnerability · Published Dec 25, 2025 · Assigned by VulDB

CVE-2025-15081JD Cloud BE6500 jdcapi sub_4780 command injection

Medium 6.3

In plain English

A medium-severity command injection in Cloud BE6500 from JD. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)2.5%top 14.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in JD Cloud BE6500 4.4.1.r4308. This issue affects the function sub_4780 of the file /jdcapi. Such manipulation of the argument ddns_name leads to command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
JD	Cloud BE6500	4.4.1.r4308

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-338409 | JD Cloud BE6500 jdcapi sub_4780 command injection vdb-entry, technical-description
VDB-338409 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #707276 | JD cloud 京东云 JD Cloud BE6500 4.4.1.r4308 Command Injection third-party-advisory
https://gist.github.com/isstabber/4ed3554130681e50b3e987c3c4ee1f29 exploit