CVE-2026-11413: Buffer Overflow in JD Cloud Box AX6600

Detection and exposure assessment

Detection will be difficult if the device has limited logging, which is common for consumer and prosumer network gear. The vulnerable code path is identified as set_macfilter in /sbin/jdcweb_rpc, which strongly suggests the issue may be triggered through a configuration or RPC-style request associated with MAC filtering. Because the public ZIP could not be unpacked in the available tooling, request structure and exploit parameters cannot be responsibly described beyond that.

In practice, defenders should focus on three questions. First, is the management interface reachable from untrusted networks? Second, are there signs of repeated requests touching MAC filtering or RPC endpoints? Third, has the device shown instability consistent with memory corruption, such as crashes, watchdog restarts, configuration resets, or unexplained reboots? A stack-based overflow does not guarantee code execution in every case; some attempts may surface first as denial-of-service symptoms.

If the device sits behind NAT and management is restricted to a trusted administrative subnet, risk is reduced but not eliminated. If remote management is internet-exposed, UPnP-created paths exist, or the router is administered through cloud-linked features you cannot validate, treat the exposure as materially higher.

Technical Notes

Because exact log field names are not confirmed from vendor documentation, use broad matching around the disclosed component and suspected function names where local logs or exported syslog are available.

Example local grep patterns:

grep -Ei "jdcweb_rpc|set_macfilter|macfilter|segfault|crash|watchdog|reboot" /var/log/* 2>/dev/null
dmesg | grep -Ei "segfault|jdcweb_rpc|stack|overflow|killed process"

Example SIEM hunting query for forwarded logs:

SELECT timestamp, host, message
FROM router_logs
WHERE message RLIKE '(jdcweb_rpc|set_macfilter|macfilter|segfault|watchdog|reboot)'
ORDER BY timestamp DESC;

Example IDS-style signature concept for management-plane traffic inspection, if HTTP payloads are visible internally. This is heuristic, not vendor-authenticated, so use it as a starting point only:

alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (
    msg:"Possible JD Cloud AX6600 set_macfilter exploit attempt";
    flow:to_server,established;
    content:"set_macfilter"; nocase;
    http_client_body;
    classtype:attempted-admin;
    sid:20611413; rev:1;
)

Network-side telemetry worth reviewing includes repeated POSTs to router admin endpoints, oversized parameter values related to MAC filter settings, and bursts immediately preceding router restarts. If no logs exist, infer likely attack attempts from monitoring gaps, reboot cycles, and configuration changes without administrator attribution.

Mitigation and patching

As of 2026-06-06, no confirmed patch or fixed version has been identified. The currently available evidence does not provide a vendor advisory, firmware release note, or bulletin naming a remediated build. Because of that, it would be inaccurate to claim a fixed version number. The only confirmed vulnerable version is 4.5.3.r4546, and the fixed version is unknown.

When the fixed version is unknown, the defensive posture should shift from patch-first to exposure-first. Restrict management access to a dedicated admin VLAN or a single hardened jump host. Disable remote administration from the internet. If MAC filtering features are not required, disable or avoid interacting with them where the interface allows. Backup configuration before making changes, because unstable devices may fail during repeated exploitation attempts or reboots.

For organizations that depend on this device in a production edge role, replacement planning may be justified if no vendor fix appears quickly. Consumer and SMB routers with publicly disclosed memory corruption flaws and no clear patch path create an outsized operational risk relative to their cost. If this hardware protects sensitive networks, compensating controls alone may not be sufficient long term.

Technical Notes

There is no confirmed vendor-issued upgrade command for a fixed firmware because no fixed firmware version is currently known. If a newer image is available through your local admin interface, validate release notes before deployment rather than assuming it addresses this CVE.

General exposure-reduction steps administrators can execute now:

# On upstream firewall or gateway, block internet access to router management
# Replace <router_wan_ip> with the exposed address if management is currently reachable
iptables -A INPUT -d <router_wan_ip> -p tcp -m multiport --dports 80,443,8080,8443 -j DROP
iptables -A INPUT -d <router_wan_ip> -p udp --dport 1900 -j DROP

If management is only needed from a trusted subnet, narrow access explicitly:

# Allow only trusted admin subnet to management ports, deny all others
iptables -A INPUT -s 192.0.2.0/24 -p tcp -m multiport --dports 80,443,8080,8443 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443,8080,8443 -j DROP

Operational workaround checklist:

1. Disable internet-exposed remote administration.
2. Restrict admin UI access to a trusted internal subnet or jump host.
3. Avoid MAC filter changes until a fix is confirmed.
4. Backup router configuration.
5. Monitor for reboot loops, crashes, and unexplained config changes.
6. Prepare to replace the device if no vendor remediation appears.

References

Primary sources used for this article:

For further reading on related vulnerabilities, check out our article on what is the difference between red team and pen test and learn about VPN appliance vulnerabilities.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.