Nexxt NCM-X1800 Router Vulnerabilities: RCE, Auth Bypass, XSS (CVE-2025-52376/7/8/9)

Critical Vulnerability Information Vulnerability Overview Device: Nexxt Solutions NCM-X1800 Mesh Router (firmware versions v1.2.7 and below) CVE IDs: CVE-2025-52379, CVE-2025-52378, CVE-2025-52377, CVE-2025-52376 Main Issues: Includes two critical remote code execution vulnerabilities, one authentication bypass leading to remote code execution, and one medium-severity stored XSS vulnerability. Detailed Vulnerability Descriptions CVE-2025-52377: Authentication Bypass Command Injection in Ping/Traceroute Description: The router’s Ping and Traceroute endpoints do not sanitize the parameter, allowing authenticated attackers to inject and execute arbitrary OS commands. Impact: Remote code execution with root privileges, full device compromise. Exploitation: See CVE-2025-52379: Authentication Bypass Command Injection in Firmware Update Description: The firmware update endpoint fails to properly validate the parameter, enabling authenticated attackers to inject OS commands with root privileges. Impact: Remote code execution, potential for persistent backdoor installation. Exploitation: See CVE-2025-52376: Telnet Enablement Authentication Bypass with Default Credentials Leading to Remote Code Execution Description: The endpoint allows remote Telnet service enablement without authentication. The Telnet server can be accessed via hardcoded credentials, granting shell access. Impact: Full device compromise, privilege escalation. Exploitation: See CVE-2025-52378: Stored Cross-Site Scripting (XSS) in Device Management Description: The device alias feature does not sanitize user input, allowing stored XSS to execute malicious JavaScript on the device management page. Impact: Session hijacking, credential theft, unauthorized administrative actions. Exploitation: See and PoC Impact Remote Code Execution: Attackers can execute arbitrary commands as root/admin. Authentication Bypass: Security controls can be bypassed, exposing the device to remote compromise. Persistent Access: Attackers can install backdoors or malware for long-term access. Disclosure Timeline May 27, 2025: Vulnerabilities first discovered May 31, 2025: Proof-of-concept for all vulnerabilities completed June 1, 2025: Initial notification to Nexxt Solutions (followed by 5 additional attempts; no response from vendor) June 14, 2025: All vulnerabilities submitted for CVE assignment July 14, 2025: Public disclosure (45 days after vendor notification)

Goal Reached Thanks to every supporter — we hit 100%!

Nexxt NCM-X1800 Router Vulnerabilities: RCE, Auth Bypass, XSS (CVE-2025-52376/7/8/9)

More from this source