This vulnerability affects JD Cloud JDCOS 4.5.1.r4518, specifically the set_iptv_info function within the /jdcap service interface. Improper handling of the vid argument allows an attacker to perform command injection remotely. The vulnerability is publicly disclosed with a CVSS 4.0 score of 5.3 (medium severity). Despite notification, the vendor has not provided a patch or mitigation. Exploit code is publicly available, increasing the risk of exploitation, although no active exploitation has been confirmed.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system via the vid argument in the set_iptv_info function. This can lead to unauthorized system control or compromise. The medium CVSS score reflects the potential impact balanced against attack complexity and privileges required. No known active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying temporary mitigations such as restricting access to the vulnerable service interface, implementing input validation or filtering on the vid parameter, and monitoring for suspicious activity related to this function. Stay alert for vendor updates or community-developed patches.