A critical buffer overflow vulnerability, designated as CVE-2026-11413, has been identified in the JingDong JD Cloud Box AX6600. This vulnerability allows an attacker to trigger memory corruption (CWE-121/CWE-122) within specific firmware processes, potentially resulting in unauthenticated Remote Code Execution (RCE) or a complete Denial of Service (DoS). Due to the hardware's function as a cloud-integrated gateway, successful exploitation allows an adversary to intercept local network traffic, establish persistent access, and facilitate lateral movement into protected internal environments. Security professionals should prioritize identifying these devices within their network architecture to prevent unauthorized pivoting.

• Vulnerability Overview

  • Identifier: CVE-2026-11413 (PT Security Reference: PT-2026-47153).
  • Affected Hardware: JingDong JD Cloud Box AX6600 cloud-integrated router.
  • Severity Rating: Critical, with high potential for unauthenticated exploitation.
  • Vulnerability Class: Memory corruption via buffer overflow.

• Technical Mechanics

  • Exploitation Vector: Memory corruption occurs when a specific service or process within the AX6600 firmware fails to perform adequate bounds checking on incoming data.
  • Execution Flow: An attacker can send malformed packets or requests to trigger the overflow, allowing for the redirection of execution flow.
  • Target Processes: Research is ongoing to isolate the exact service, but the flaw resides in the device's handling of network-facing communication protocols.

• Impact and Exploitation Potential

  • System Compromise: Successful exploitation can lead to full Remote Code Execution (RCE) with elevated privileges.
  • Network Pivoting: As a gateway device, a compromised AX6600 serves as a high-value pivot point for lateral movement within the local network.
  • Data Interception: Attackers may gain the ability to perform man-in-the-middle (MitM) attacks to intercept sensitive traffic.
  • Availability Loss: Malformed inputs can be used to crash critical services, resulting in a persistent Denial of Service (DoS).

• Defensive Recommendations

  • Patch Management: Immediately monitor for and apply official firmware updates provided by JingDong.
  • Network Segmentation: Isolate AX6600 devices within dedicated VLANs to limit the blast radius of a potential compromise.
  • Traffic Monitoring: Implement deep packet inspection (DPI) to detect anomalous patterns or malformed requests targeting management interfaces.
  • Access Control: Restrict administrative access to the device to trusted internal IP ranges only.