Vulnerability · Published Feb 16, 2026 · Assigned by VulDB

CVE-2026-2563JingDong JD Cloud Box AX6600 jdcapp_rpc controlDevice get_status privileges management

Medium 6.3

In plain English

A medium-severity privilege mismanagement in JD Cloud Box AX6600 from JingDong. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.5%top 57.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. Affected is the function set_stcreenen_deabled_status/get_status of the file /f/service/controlDevice of the component jdcapp_rpc. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
JingDong	JD Cloud Box AX6600	4.5.1.r4533

Weakness: CWE-269, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-346170 | JingDong JD Cloud Box AX6600 jdcapp_rpc controlDevice get_status privileges management vdb-entry, technical-description
VDB-346170 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #750987 | JingDong Cloud NAS Router AX6600 (4.5.1.r4533 and earlier) Remote Command Execution third-party-advisory
Submit #750992 | JingDong Cloud NAS Router AX6600 (4.5.1.r4533 and earlier) Remote Command Execution (Duplicate) third-party-advisory
https://my.feishu.cn/wiki/T3pjwxZtYiU4Gfkl6iUc3CzVnRe exploit