CVE-2026-75340
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The device metadata import interface /device/instance/{productId}/property-metadata/import in jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).
Risk Assessment
An attacker can exploit this vulnerability to make requests from the server to internal network resources, potentially leading to disclosure of sensitive information or further attacks.
Recommendation
It is recommended to restrict access to this interface and implement URL validation and filtering to prevent SSRF.
Other vulnerabilities in jetlinks community
See all- CVE-2026-110110Medium
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.
- CVE-2026-110109Medium
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.
Original NVD description (English source)
The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS