JetLinks Community EUVD-2026-98943

Requires an authenticated JetLinks Community account (through version 2.10.0) that holds at least query access to alarm configurations; the attacker then invokes the AlarmConfigController _enable or _disable endpoints with a known alarm configuration id, which succeed because those endpoints omit the save action annotation that would normally require write/save authorization. Limiting factors: exploitation is NOT unauthenticated (PR:L - valid low-privilege credentials are mandatory), there is no user-interaction requirement, impact is confined to toggling alarm enablement (integrity only, no data disclosure or service outage), and an attacker must know or enumerate valid alarm configuration ids.

This is a genuine but modest-severity broken-access-control issue, not a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 Medium score are internally consistent with the description: exploitation is network-reachable and low-complexity, but requires an authenticated account (PR:L) that already holds query access, and the only impact is low integrity (VI:L) - toggling alarm enable/disable state - with no confidentiality (VC:N) or availability (VA:N) impact. No EPSS score, CISA KEV listing, or published exploit code is present in the provided data, so there is no public exploit identified at time of analysis. The real-world risk is best characterized as a privilege-escalation/insufficient-authorization flaw whose danger is contextual: an insider or compromised low-privilege account can blind operators to device alerts, which is a meaningful secondary/stepping-stone risk in an IoT monitoring platform but is not mass-exploitable against the internet at large because valid credentials are required. The hackmd write-up and VulnCheck advisory are analyses of the missing save-action annotation rather than confirmed weaponized exploits; do not treat them as active-exploitation evidence.

A user granted only read/query permissions on the JetLinks Community dashboard discovers that the AlarmConfigController _enable and _disable endpoints do not enforce the save action, and directly invokes them with an alarm configuration id. The attacker disables alarms for targeted devices so that subsequent tampering or outages generate no alerts, blinding monitoring staff. No public exploit code is identified, and the action requires an authenticated low-privilege session (PR:L), but the low attack complexity makes abuse trivial once such access exists.