The vulnerability resides in the cast_streen function of the jdcapi component on JingDong JD Cloud Box AX6600. By manipulating the File argument, an attacker can obtain elevated privileges on the device, a classic case of insecure privilege management (CWE‑266) combined with improper access control (CWE‑269). The flaw permits remote privilege escalation without authentication.

This flaw affects JingDong JD Cloud Box AX6600 devices running firmware up to version 4.5.1.r4533. Devices with any older firmware are likely vulnerable, and the component is exposed through the jdcweb_rpc interface.

The CVSS base score of 5.3 indicates a moderate severity. EPSS <1% suggests a very low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the attack can be performed remotely, any exposed device could suffer unauthorized privilege escalation if no mitigation is applied. The likely attack vector is network‑based, leveraging the publicly documented manipulation of the File parameter.