CVE-2026-11413: JingDong JD Cloud Box AX6600 jdcweb_rpc set_macfilter stack-based overflow

Synopsis

A stack-based buffer overflow exists in the set_macfilter function of the jdcweb_rpc binary on the JingDong JD Cloud Box AX6600 (firmware 4.5.3.r4546). The vulnerability is reachable over the network by an authenticated user with a low-privilege account, with no victim interaction required. Successful exploitation gives an attacker full read, write, and availability impact on the device, enabling remote code execution or complete device takeover. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the jdcweb_rpc service over the network; the vulnerability is remotely exploitable without requiring local or physical access.

• AuthenticationRequired

  A low-privilege account is sufficient to trigger the vulnerability; no administrative credentials are needed.

• Victim interactionNot required

  No victim interaction is needed; the attacker can trigger the overflow directly without any user action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental prerequisites.

Blast Radius

• A successful attacker reads all data accessible to the jdcweb_rpc process, including stored credentials, session tokens, and device configuration.
• A successful attacker writes arbitrary data to the device, enabling persistent configuration changes or implanting malicious code.
• A successful attacker can crash or take over the jdcweb_rpc service, disrupting device management and network routing functions.
• Because a public proof-of-concept exploit has been disclosed, the barrier to exploitation is low for any attacker who can authenticate to the device.