Jetlinks CVEs and Security Vulnerabilities

CVE-2026-110110

JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jetlinks

Products

Jetlinks Community

CVE-2026-110109

JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed