A flaw in the web_get_ddns_uptime function of the /jdcapi endpoint in the jdcweb_rpc component allows an attacker to manipulate a request and gain higher privileges on the device. The vulnerability exploits incorrect privilege management, enabling an unauthenticated or low-privileged user to achieve elevated access, potentially compromising the entire JD Cloud Box AX6600 device. The weakness is categorized as CWE-266 and CWE-269, indicating improper privilege escalation and potential hard‑coded or weak credential handling.

The issue affects JingDong JD Cloud Box AX6600 units running firmware versions up to 4.5.1.r4533. Devices that expose the /jdcapi web_get_ddns_uptime endpoint to the network are vulnerable, including those accessible via remote management interfaces.

The CVSS score of 5.3 classifies the vulnerability as medium severity, and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but an exploit has been made public, meaning attackers could potentially use it without a formal disclosure. The attack vector is remote, relying on reachability of the web API. Organizations should prioritize applying the latest firmware update or otherwise restrict remote access to mitigate the risk.