CVE-2026-75340

CriticalCVSS 9.1

Published: 26/08/2026(UTC)Updated: 27/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

The device metadata import interface /device/instance/{productId}/property-metadata/import in jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).

Risk Assessment

An attacker can exploit this vulnerability to make requests from the server to internal network resources, potentially leading to disclosure of sensitive information or further attacks.

Recommendation

It is recommended to restrict access to this interface and implement URL validation and filtering to prevent SSRF.

Original NVD description (English source)

The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).