CVE-2026-110109 in Community
Summary
by MITRE • 10/13/2026
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in JetLinks Community versions up to 2.10.0 represents a critical failure in access control mechanisms within the platform's device management subsystem. Specifically, this flaw resides in the endpoint responsible for managing transparent codecs, which are essential components for interpreting and generating data payloads from IoT devices. The core issue is a missing authorization check on the POST /device/transparent-codec/{productId} API route. In secure software architecture, endpoints that modify state or configuration must enforce strict verification of user permissions to ensure that only authorized administrators can alter system behavior. However, in this implementation, the endpoint lacks the necessary @SaveAction annotation or equivalent security middleware that would validate whether the requesting user possesses write privileges for the specified product's codec configurations. Consequently, any authenticated user with merely query-level access rights is able to execute state-changing operations intended exclusively for higher-privileged roles.
From a technical perspective, this vulnerability allows an attacker to inject arbitrary codec providers and configuration parameters into the system. Transparent codecs are responsible for decoding incoming telemetry data from devices and encoding responses back to them. By exploiting this flaw, an adversary can overwrite these critical logic components with malicious code or misconfigured scripts. This capability effectively grants the attacker control over how all messages associated with a specific product ID are processed by the JetLinks platform. The impact is severe because it bypasses standard input validation and security boundaries that rely on role-based access controls. Instead of being restricted to reading device data, an unauthorized user can fundamentally alter the interpretation logic for every device belonging to the targeted product line.
The operational implications of this vulnerability are profound and extend beyond simple data manipulation. Since codecs dictate how raw binary or string data is parsed into meaningful telemetry fields, a compromised codec can lead to complete loss of visibility into device status. An attacker could craft malicious payloads that cause parsing errors, leading to denial-of-service conditions where devices appear offline due to unparseable messages. More dangerously, the attacker can manipulate decoded values to inject false sensor readings or command parameters. If these manipulated data points are consumed by downstream applications for automation, analytics, or control loops, it could result in physical damage to connected equipment, incorrect business decisions based on corrupted telemetry, or further exploitation of other system components that trust this data as authoritative source truth.
This vulnerability aligns with CWE-269, which classifies Improper Privilege Control, specifically where a user is able to perform actions beyond their assigned permissions. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on using legitimate but insufficiently privileged credentials to escalate influence over system configuration. Furthermore, it relates to CWE-94, Improper Control of Generation of Code (Code Injection), because the ability to save arbitrary codec providers allows for the execution of unintended code within the platform's processing pipeline. The lack of proper authorization checks creates a direct path for privilege escalation from read-only access to full administrative control over device communication logic.
To mitigate this vulnerability, immediate action is required to patch the JetLinks Community software to version 2.10.1 or later, where the missing authorization check has been addressed. In environments where upgrading is not immediately feasible, network-level controls should be implemented to restrict access to the /device/transparent-codec endpoints exclusively from trusted administrative interfaces and internal service accounts. Additionally, organizations should audit their existing user roles to ensure that query-only users do not have unnecessary API exposure. Implementing strict input validation on codec provider fields can also help limit the impact of any successful exploitation by preventing arbitrary code execution within the codec logic. Regular security assessments focusing on role-based access control for all state-changing endpoints are essential to prevent similar misconfigurations in IoT management platforms.