CVE-2026-75340: SSRF
The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The available data identifies the affected endpoint but does not state whether it requires authentication or specific privileges. Exposure therefore depends on whether attackers can reach /device/instance/{productId}/property-metadata/import in the deployment.
How can I determine whether my deployment is affected?
Check whether the deployment uses jetlinks community 2.11 and exposes the device metadata import interface at /device/instance/{productId}/property-metadata/import. The provided data does not include request details or indicators that would confirm exploitation.
What mitigation is available if patching cannot be done immediately?
The provided data does not identify a fixed version or vendor workaround. Restrict access to the affected import endpoint and limit the application's outbound network access where operationally feasible to reduce SSRF exposure.