EUVD-2026-66813
GHSA-pwh3-7crv-9wh2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach JetLinks management interface
-
DeliveryCall property-metadata import with crafted URL
-
ExploitServer issues attacker-controlled request
-
ExecutionRelay to internal/metadata service
-
ImpactExfiltrate internal data or pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to reach and invoke the specific endpoint /device/instance/{productId}/property-metadata/import on a JetLinks Community 2.11 instance and supply a metadata source (URL/reference) that the server dereferences server-side; a valid productId path value is needed. The CVSS vector marks PR:N (no privileges), but because this is a device-management import function it most likely requires an authenticated/authorized session in default deployments - authentication requirements are not conclusively confirmed from the available data and should be verified with the vendor. Limiting factors: network reachability to the JetLinks web/management interface, the import feature being enabled, and (probably) an authenticated management context; internet-exposed instances and cloud-hosted deployments (where a metadata endpoint is reachable) materially increase real-world impact. |
| Impact | The raw signals are split: CVSS 3.1 is 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H) and SSVC flags it automatable=yes with total technical impact, which argues for urgency, yet EPSS is only 0.14% (4th percentile) and there is no KEV listing, indicating no evidence of widespread exploitation despite a public POC. The most important caveat is an authentication discrepancy: the CVSS vector claims PR:N (unauthenticated), but the vulnerable path is a device-management import interface (/device/instance/...) that in typical JetLinks deployments sits behind authentication - this should be verified against the vendor before treating it as anonymously reachable. Treating SSRF impact as C:H/I:H is also generous; SSRF primarily yields confidentiality/relay impact, so the 9.1 likely overstates integrity. Net assessment: a genuinely serious SSRF worth prompt patching for internet-exposed JetLinks instances (especially in cloud environments where metadata-endpoint theft is possible), but the low EPSS and probable authentication requirement suggest targeted rather than mass exploitation risk. |
| Exploit ScenarioDerived | An attacker who can reach the JetLinks management interface submits a device property-metadata import request whose metadata source points at an internal URL - for example the cloud instance-metadata service or an internal admin API. The JetLinks server fetches that URL and returns or acts on the response, letting the attacker read internal data or pivot to services unreachable from the internet. A public POC/write-up exists, and with AV:N/AC:L the request is low-complexity to craft. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Server-side request forgery in JetLinks Community 2.11 lets attackers abuse the device metadata import endpoint (/device/instance/{productId}/property-metadata/import) to coerce the server into issuing arbitrary outbound requests. Because the platform sits at the IoT control layer, this can be used to reach internal-only services, cloud metadata endpoints, and other network-segment resources normally shielded from the internet. A public write-up/POC exists (GitHub) and SSVC rates the flaw as automatable with total technical impact, though EPSS remains low (0.14%) and it is not on CISA KEV, so no public exploit identified at time of analysis as active exploitation.
RemediationAI
No vendor-released patch identified at time of analysis - the available references are a third-party POC write-up, VulDB, and NVD, none citing a fixed release version, so upgrade guidance must be confirmed with the JetLinks project (github.com/jetlinks) before relying on it. As compensating controls: restrict network reachability to the /device/instance/{productId}/property-metadata/import endpoint (and the management UI generally) to trusted admin networks via reverse-proxy allow-listing, which limits exposure but blocks legitimate remote admins; enforce and verify authentication/authorization on the import function if any anonymous access is possible; place the JetLinks backend behind an egress firewall that denies outbound requests to internal/RFC1918 ranges, loopback, and cloud metadata IPs (169.254.169.254), accepting that this can break legitimate integrations that fetch external metadata; and monitor for anomalous server-initiated outbound connections originating from the import feature. Consult https://vuldb.com/vuln/396041 and the NVD entry for updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetLinks Community is an open-source Java/Spring-based IoT device management platform used to onboard, model, and orchestrate connected devices. The affected function is the property-metadata import feature, which accepts a device product's metadata definition - the classic SSRF (CWE-918) root cause is that a user-controlled reference/URL supplied to this importer is fetched server-side without validating or restricting the destination. As a result the JetLinks backend acts as a proxy: the CWE-918 weakness class means the server dereferences an attacker-influenced location, allowing requests to internal hosts, link-local metadata (e.g. 169.254.169.254), or loopback admin services that the attacker cannot reach directly.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SSRF via a device-management import endpoint most likely needs an authenticated session (PR:L); primary impact is confidentiality/relay (C:H) with limited integrity and no availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).
Executive ViewAI
A critical server-side request forgery vulnerability in JetLinks Community 2.11 allows attackers to manipulate the platform into making unauthorized requests to internal infrastructure and cloud metadata endpoints, directly compromising network segmentation at the IoT control layer. This exposes sensitive internal resources and metadata that organizations depend on for IoT device management and operational safety. With no vendor patch currently available and the flaw rated as automatable, organizations running this version face immediate and persistent risk to their operational technology infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) isolate JetLinks Community 2.11 instances to a restricted network segment with no access to internal resources or cloud metadata services; (2) disable or restrict the vulnerable /device/instance/{productId}/property-metadata/import endpoint if operational requirements permit; (3) implement egress firewall rules blocking outbound connections to internal networks and cloud metadata endpoints; (4) deploy network-based intrusion detection to monitor and alert on unexpected outbound traffic from affected instances; (5) restrict and audit administrative access to the platform.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB