Server-Side Request Forgery Vulnerability in JetLinks Community Software by JetLinks
CVE-2026-75340

9.1CRITICAL

Key Information:

Vendor

JetLinks

Status
JetLinks Community
Vendor
CVE Published:
26 August 2026

What is CVE-2026-75340?

The JetLinks Community software version 2.11 contains a vulnerability in its device metadata import interface, specifically at /device/instance/{productId}/property-metadata/import. This vulnerability allows attackers to perform server-side request forgery (SSRF), potentially exposing sensitive internal resources to unauthorized access. It poses a significant threat as it can be exploited to access backend systems, compromise data, and breach network security.

References

https://github.com/fangtang7/CVE/blob/main/jetlinks-commu...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.