The vulnerability stems from a missing authorization check on the AlarmConfigController _enable and _disable endpoints. As a result, any authenticated user that has permission to query the system can toggle the state of any alarm configuration by using the alarm's identifier. This flaw allows attackers to silence or enable alerts in order to conceal malicious or abnormal device behavior. The vulnerability is classified as CWE‑862, indicative of missing authorization.

Affected systems include JetLinks Community versions up to and including 2.10.0. The flaw resides in the AlarmConfigController within the rule‑engine-manager module and targets the endpoints that toggle alarm status. Users of the community edition who are logged in and have simple query rights are capable of executing these endpoints, regardless of whether they have authorisation to modify alarm settings.

The CVSS score of 5.3 denotes moderate impact, and the EPSS score is not available, with no listing in CISA KEV. Attackers only need to send a crafted HTTP request to the protected endpoints; authentication is insufficient to mitigate the problem if the user already has query permissions. Because the flaw does not lead to code execution or data exfiltration, the primary risk lies in disabling alerts to evade detection.