Vendor of the products: 京东云
Vendor’s website: https://jdbox.jdcloud.com/
Reported by: Zhuang Haoran (1851805232@163.com)
Affected models and versions :
JDCOS-JDC08-4.5.1.r4518
Firmware download address:
https://3.cn/10B-Q0ElN password : ve8tjk
A remote code execution (RCE) vulnerability exists in multiple JD Cloud Wireless Treasure IoT devices, posing a severe security risk to affected equipment. The root cause of this flaw lies in the lack of proper input validation, filtering, and sanitization for externally controllable command parameters within the device’s service interface. These untrusted parameters are directly concatenated into system command-line arguments without any restriction on special shell metacharacters or command separators, creating a straightforward command injection vector. Exploiting this vulnerability, remote attackers can craft and send maliciously constructed request messages to the vulnerable service interface exposed by the target device. By injecting arbitrary operating system commands into the parameter fields, they can achieve unauthorized code execution on the underlying system of the compromised IoT device, fully taking control of the device and performing malicious operations at will.
When the URL is /jdcapi and the request body JSON carries the set_iptv_info field, call function pointers according to the jdcapi_static_web_get_ddns_status(0x1897C) from /sbin/jdcweb_rpc
Then the function will get parameters enable , vlan_enable , vid, port , priority from JSON request body
While :