CVE-2026-11413 in JD Cloud Box AX6600
Summary
by MITRE • 06/06/2026
A security vulnerability has been detected in JingDong JD Cloud Box AX6600 4.5.3.r4546. The impacted element is the function set_macfilter of the file /sbin/jdcweb_rpc. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/12/2026
The JingDong JD Cloud Box AX6600 device presents a critical stack-based buffer overflow vulnerability within its firmware version 4.5.3.r4546. This vulnerability exists in the set_macfilter function located in the /sbin/jdcweb_rpc binary file, representing a significant security weakness that compromises the device's integrity and operational security. The flaw stems from improper input validation and memory management practices within the network management functionality of the device's web interface, creating an exploitable condition that allows malicious actors to manipulate memory structures through crafted input parameters.
The technical exploitation of this vulnerability occurs through remote manipulation of the set_macfilter function, which processes MAC address filtering configurations. When an attacker sends specially crafted data to this function, the device fails to properly bounds-check the input before copying it to a fixed-size stack buffer. This condition results in a classic stack-based buffer overflow where excess data overwrites adjacent memory locations including return addresses and control data. The vulnerability's remote exploitability means that attackers can trigger this condition without physical access to the device, making it particularly dangerous for network-connected IoT devices.
The operational impact of this vulnerability extends beyond simple privilege escalation or denial of service scenarios. Attackers can potentially achieve arbitrary code execution on the device, allowing them to gain full control over the JD Cloud Box AX6600 system. This could enable unauthorized network access, data exfiltration, or the device to be used as a pivot point for attacking other systems within the network. The lack of vendor response to early disclosure efforts compounds the risk, as no official patches or mitigations are currently available to protect users from this known vulnerability. The public disclosure of exploitation techniques further increases the likelihood of real-world attacks against affected devices.
Security professionals should implement immediate network segmentation and monitoring to detect potential exploitation attempts targeting this vulnerability. The absence of vendor response creates an urgent need for community-driven mitigation strategies including firewall rules blocking access to the vulnerable web interface, network intrusion detection systems configured to identify exploitation patterns, and proactive device replacement where possible. This vulnerability aligns with common attack patterns documented in the attack framework, particularly those involving remote code execution in IoT devices and represents a significant concern for organizations relying on unpatched network infrastructure. The vulnerability's classification as a stack-based buffer overflow corresponds to CWE-121, which specifically addresses stack-based buffer overflow conditions. Mitigation efforts should include comprehensive network monitoring for unusual traffic patterns, implementation of network access controls, and consideration of device retirement or replacement until vendor patches become available. Organizations should also consider the broader implications of this vulnerability within their security posture, as it demonstrates the risks associated with unpatched IoT devices and the importance of proactive vulnerability management strategies.