CVE-2026-121926 Details
Description
A vulnerability was detected in yezhihao jt808-server up to a07f68c466b560b97ef41edb8a4966469abdf83e. Affected is the function WebMvcConfig.addInterceptors of the component Web Management API. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in the Yezhihao JT808-Server's Web Management API, specifically in versions up to commit a07f68c466b560b97ef41edb8a4966469abdf83e. The issue arises from the absence of authentication in the WebMvcConfig.addInterceptors function, leaving all command endpoints under '/device/' unprotected. This vulnerability allows remote attackers to inject arbitrary commands into the vehicle command system, potentially leading to unauthorized control over vehicle functions.
To address this vulnerability, it is recommended to implement authentication and authorization for the web management API, using frameworks like Spring Security. Additionally, the management port should be bound to '127.0.0.1' by default, with external access requiring explicit configuration. CORS settings should be tightened to remove broad allowances and use an origin allow-list. Disabling Swagger in production profiles and requiring configuration for FTP credentials are also advised.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/janceye26-svg/eddbfcd42bbd90613dddcb7965408bf9 | [email protected] | ExploitRemedy |
| https://vuldb.com/cve/CVE-2026-121926 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1023350 | [email protected] | Permission Required |
| https://vuldb.com/vuln/431035 | [email protected] | Permission Required |
| https://vuldb.com/vuln/431035/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yezhihao jt808-server | <= a07f68c466b560b97ef41edb8a4966469abdf83e |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |