9.8

CVE-2025-66848

JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.5.1.r4518 and earlier) contain an unauthorized remote command execution vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jdcloud ≫ Ax1800 Firmware Version <= 4.3.1.r4308
   Jdcloud ≫ Ax1800 Version -
Jdcloud ≫ Ax3000 Firmware Version <= 4.3.1.r4318
   Jdcloud ≫ Ax3000 Version -
Jdcloud ≫ Ax6600 Firmware Version <= 4.5.1.r4533
   Jdcloud ≫ Ax6600 Version -
Jdcloud ≫ Be6500 Firmware Version <= 4.4.1.r4308
   Jdcloud ≫ Be6500 Version -
Jdcloud ≫ Er1 Firmware Version <= 4.5.1.r4518
   Jdcloud ≫ Er1 Version -
Jdcloud ≫ Er2 Firmware Version <= 4.5.1.r4518
   Jdcloud ≫ Er2 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.95% 0.583
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://www.notion.so/JD-Cloud-Unauth-RCE-2d22b76e8e0c802c975bf186b208d0c2
Permissions Required
https://www.jdcloud.com/cn/
Product