The vulnerability arises from an omitted @SaveAction annotation on the POST /device/transparent-codec/{productId} endpoint. Users with query-level read access can exploit this to overwrite product‑specific codec providers and their parameters. This means any device belonging to the affected product will process messages according to a tampered codec, allowing data manipulation, injection of malformed payloads, or execution of arbitrary code if the codec performs code during processing. The flaw bypasses intended authorization controls and grants attackers full control over codec behavior for all devices of the product.

JetLinks Community versions 2.10.0 and earlier are affected. The issue resides in the platform core, specifically the transparent codec controller component, and is present in the community edition of the IoT platform widely used for device communication.

The CVSS score of 7.1 indicates high impact with moderate to high exploitability. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting a lower current threat level, though the attack vector requires only read-level access. An attacker who can query the transparent-codec endpoint can issue an authenticated POST, bypassing normal write permissions, and immediately alter codec settings. Once the override occurs, all devices for that product may become vulnerable to arbitrary data handling or code execution, making the vulnerability a serious risk for environments using these releases.