Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated command injection vulnerability in the firmware update feature. The /web/um_fileName_set.cgi and /web/um_web_upgrade.cgi endpoints fail to properly sanitize the upgradeFileName parameter, allowing authenticated attackers to execute arbitrary OS commands on the device, resulting in remote code execution.
References
Configurations
No configuration.
History
15 Jul 2025, 20:07
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-15 15:15
Updated : 2025-07-15 20:07
NVD link : CVE-2025-52379
Mitre link : CVE-2025-52379
CVE.ORG link : CVE-2025-52379
JSON object : View
Products Affected
No product.
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')