JetLinks Community CVE-2026-110109

Requires an authenticated JetLinks Community account (through 2.10.0) that holds at least query-level access to the transparent-codec resource; the attacker then issues POST /device/transparent-codec/{productId}. The root cause is that this save endpoint lacks the @SaveAction authorization annotation, so no special product configuration or feature toggle is needed - default deployments are affected. The primary limiting factor is the PR:L prerequisite: an attacker must already possess valid credentials with query permission on that resource (so an existing low-privilege user, leaked token, or compromised account), which prevents anonymous internet-wide exploitation.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.1 (High) and describes a network-reachable, low-complexity flaw whose impact is confined to integrity (VI:H) with no confidentiality or availability loss (VC:N/VA:N) and no subsequent-system scope change (SC:N/SI:N/SA:N). The decisive mitigating signal is PR:L: exploitation requires an authenticated account that already holds at least query access to the transparent-codec resource, so this is NOT a mass, unauthenticated internet-facing bug - it requires a foothold or an over-provisioned low-privilege user. No EPSS score, no CISA KEV entry, and no explicit POC flag were supplied in the input, so exploitation probability cannot be quantified; however, a detailed technical write-up (hackmd) and a VulnCheck advisory exist, lowering the barrier to weaponization. SSVC decision data was not provided. Signal conflict to note explicitly: the input Tag 'Authentication Bypass' disagrees with CWE-862 (Missing Authorization) and with PR:L - the attacker IS authenticated and is bypassing an authorization check, not authentication; defenders should treat this as a broken-access-control/privilege issue. Net: a genuine but moderate priority - real integrity risk to device message handling, gated behind requiring a valid low-privileged account.

An attacker holding a low-privileged JetLinks account with only query access to transparent-codec sends a POST to /device/transparent-codec/{productId} to save a malicious codec provider and configuration. Because the controller endpoint omits the @SaveAction authorization annotation, the write is accepted, letting the attacker dictate how transparent messages are encoded and decoded for every device of that product. No public exploit is flagged, but a detailed technical write-up describing the exact vulnerable controller lines has been published.