Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110109— JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save

Quick assessment

Affected
jetlinks JetLinks Community
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

JetLinks Community 2.10.0 及之前版本存在一个缺失授权检查的安全漏洞，攻击者可通过向 POST /device/transparent-codec/{productId} 发送请求，利用仅具有透明编码器查询权限的用户身份，覆盖产品对应的透明编码器。由于该接口未配置 @SaveAction 权限校验机制，攻击者可保存任意编码器提供商及其配置，从而控制该产品下所有设备的透明消息的解码与编码行为。

CVSS 6.5 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
jetlinks JetLinks Community ≤ 2.10.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110109

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save
Source: CVE Program / CVE List V5
Vulnerability Description
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
jetlinks JetLinks Community 0 ~ 2.10.0 -

II. Public POCs for CVE-2026-110109

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110109

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110109 (1)

Vendor Advisories for CVE-2026-110109 (1)

Security Blog Posts for CVE-2026-110109 (1)

IV. Related Vulnerabilities

Same product: JetLinks Community
Same vendor: jetlinks
Same weakness: CWE-862

V. Comments for CVE-2026-110109

No comments yet

Leave a comment