Nexxt Solutions NCM-X1800 Firmware Update Command Injection (CVE-2025-52379)

Key Information Summary Vulnerability Overview Vulnerability Name: Nexxt Solutions NCM-X1800 Mesh Router - Authenticated Command Injection Vulnerability in Firmware Update Feature CVE ID: CVE-2025-52379 Affected Product: Nexxt Solutions NCM-X1800 Mesh Router Affected Versions: U1.2.7 and earlier Vulnerability Type: Command Injection leading to Remote Code Execution (RCE) Discovery Details Discovery Process: During investigation of the NCM-X1800 Mesh Router's web interface, it was found that the firmware update feature improperly handles the filename parameter. Attackers can inject malicious commands during the firmware update process to execute arbitrary commands. Technical Details Vulnerable Location: Firmware update feature, accessible via the router's web management interface. Specific Issue: The web endpoints and do not properly sanitize the user-supplied parameter, allowing attackers to inject shell commands using command separators (;). Impact Potential Risks: - Full control over the affected router - Access to internal network resources - Creation of persistent backdoors - Potential compromise of the entire network Proof of Concept (PoC) PoC Description: A proof-of-concept exploit has been developed to demonstrate the vulnerability. The accompanying script: 1. Logs into the router's web interface using the default password 12345678. 2. Injects a command into the parameter to download a malicious payload. 3. Makes the payload executable. 4. Executes the payload to establish a reverse shell. Disclosure Timeline 2025-05-28: Vulnerability discovered 2025-05-31: Proof-of-concept/exploit developed 2025-06-01: Initial notification to Nexxt Solutions

Goal Reached Thanks to every supporter — we hit 100%!

Nexxt Solutions NCM-X1800 Firmware Update Command Injection (CVE-2025-52379)

More from this source