CVE-2025-8890

Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to a shell command injection attacks. In order to exploit this vulnerability, an attacker has to log in to the router's administrative portal, which by default is reachable only via LAN ports.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2025/11/CVE-2025-8890
https://www.securitum.com/cve-2025-8890.html
https://www.securitum.com/cve-2025-8890.html

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El firmware en versiones anteriores a la 7.1.12.2.44 de los routers SDMC NE6037 tiene una herramienta de diagnóstico de red vulnerable a ataques de inyección de comandos de shell. Para explotar esta vulnerabilidad, un atacante tiene que iniciar sesión en el portal administrativo del router, el cual, por defecto, es accesible solo a través de los puertos LAN.

Information

Published : 2025-11-27 14:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-8890

Mitre link : CVE-2025-8890

CVE.ORG link : CVE-2025-8890

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-8890", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8890", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-18T18:33:37.444350Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "SDMC", "product": "NE6037", "versions": [{"status": "affected", "version": "0", "lessThan": "7.1.12.2.44", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-27T14:15:52.183", "references": [{"url": "https://cert.pl/en/posts/2025/11/CVE-2025-8890", "source": "cvd@cert.pl"}, {"url": "https://www.securitum.com/cve-2025-8890.html", "source": "cvd@cert.pl"}, {"url": "https://www.securitum.com/cve-2025-8890.html", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44\u00a0has a network diagnostics tool vulnerable to a shell command injection attacks.\nIn order to exploit this vulnerability, an attacker has to log in to the router's administrative portal, which by default is reachable only via LAN ports."}, {"lang": "es", "value": "El firmware en versiones anteriores a la 7.1.12.2.44 de los routers SDMC NE6037 tiene una herramienta de diagn\u00f3stico de red vulnerable a ataques de inyecci\u00f3n de comandos de shell. Para explotar esta vulnerabilidad, un atacante tiene que iniciar sesi\u00f3n en el portal administrativo del router, el cual, por defecto, es accesible solo a trav\u00e9s de los puertos LAN."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "cvd@cert.pl"}