CVE-2025-34117

216.73.217.80

· Published 16/07/2025 21:15 · Modified 17/07/2025 21:15

Labels: CVE-2025-34117 2025-07-16 CVE-2025-34117 CWE-78 [email protected]

Essential information

Published: 16/07/2025 21:15
Modified: 17/07/2025 21:15
Author: —
Creator: —
CVSS: 9.3 CRITICAL (v3) 9.3 CRITICAL (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. This backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.

NVD status

Status: Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
netcore / router	`cpe:2.3:a:netcore:router::::::::`
netis / router	`cpe:2.3:a:netis:router::::::::`