External risk intelligence

Jetlinks Community SSRF Vulnerability in Device Metadata Import

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-75340

The vulnerability exists in a device metadata import interface within the JetLinks platform. As an IoT platform, these interfaces are commonly deployed as network-accessible services to facilitate device connectivity, management, and configuration, making them frequently exposed to the network edge in operational deployments.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the JetLinks community platform's device metadata import feature could allow unauthorized access to internal systems by tricking the system into making requests on behalf of an attacker. This could potentially expose sensitive information or allow further compromise of your connected device environment. The main concern is confirming relevance and exposure.

It affects a device management feature.
Protects against potential system access.
Verify platform relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a malicious request to the device metadata import interface. This interface, accessible over the network, is susceptible to Server-Side Request Forgery (SSRF) if not properly secured. By tricking the interface into making unintended requests to internal or external resources, an attacker could potentially access sensitive information or disrupt services.

Network exposure required.
Malicious import request triggers vulnerability.
Leads to unauthorized resource access.

Live Threat

Current exploitation, exposure, and threat context

A server-side request forgery vulnerability in the device metadata import interface could allow an unauthenticated attacker to make the server perform arbitrary requests to internal or external resources. This could lead to the disclosure of sensitive information or manipulation of internal services when supported by the advisory's specific conditions.

Server-side request forgery.
Unauthenticated network requests.
Disclosure of system or service information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the JetLinks platform's device metadata import interface requires a coordinated response. Application owners are responsible for the JetLinks platform itself, while infrastructure and network/security teams must assess external reachability and potential impact. Vendor management may be involved if the platform is sourced externally. The initial priority is to identify all instances of the affected interface, confirm exposure and criticality, and then engage the accountable owner to plan remediation, potentially involving vendor coordination.

Identify affected instances and owners.
Verify external reachability and impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JetLinks Community?

JetLinks Community is an open-source IoT (Internet of Things) platform designed to manage, connect, and configure various devices. It provides a centralized dashboard and framework for handling large-scale device communication and data processing, which is why it often includes specialized interfaces for importing device metadata and managing system properties.

What does SSRF mean for CVE-2026-75340?

This CVE involves Server-Side Request Forgery (SSRF), categorized as CWE-918. It means an attacker can manipulate the JetLinks server into making unauthorized network requests to other locations. Instead of accessing the server directly, the attacker uses the server as a proxy to reach internal or external resources that they would not normally be able to interact with.

How can an attacker trigger this vulnerability?

The bug is triggered by sending a specially crafted request to the specific device metadata import endpoint within JetLinks. The system becomes vulnerable when it processes these malicious imports without validating the destination of the resulting network calls. Simply accessing the platform's login page or general dashboard does not trigger this flaw; it requires interacting with the specific metadata import function.

Is my JetLinks instance at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant if your JetLinks platform is deployed as a network-accessible service. Because IoT platforms are often placed at the network edge to facilitate device connectivity, they are frequently reachable by outside parties. If your specific instance is exposed to the internet, it is more likely to be reachable by unauthorized actors compared to an instance restricted to an internal-only network.

Do I need to take action if I use this software?

Yes. Your first step should be to identify every instance of the JetLinks platform running in your environment and determine which ones have the metadata import interface accessible over the network. Once you have an inventory of these instances, work with your infrastructure or security teams to restrict access to the interface, confirm the level of exposure, and plan for necessary updates or configuration changes.

References

github.com/fangtang7/CVE/blob/main/jetlinks-community/ssrf.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.