CVE-2026-110109
MediumCVSS 6.5Summary
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.
Risk Assessment
The risk includes gaining control over data formatting in devices, potentially enabling manipulation of measurement data or compromising communication integrity.
Recommendation
Add the @SaveAction annotation to the transparent-codec endpoint and ensure only authorized users can modify codec configurations.
Other vulnerabilities in JetLinks Community
See all- CVE-2026-110110Medium
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.
- CVE-2026-75340Critical
The device metadata import interface /device/instance/{productId}/property-metadata/import in jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).
Original NVD description (English source)
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS