CVE-2025-52379

Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated command injection vulnerability in the firmware update feature

Medium · published July 15, 2025

CVSS v3.1

5.4

EPSS

16%

Percentile

96.9

In the wild

Unconfirmed

What it is

Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated command injection vulnerability in the firmware update feature. The /web/um_fileName_set.cgi and /web/um_web_upgrade.cgi endpoints fail to properly sanitize the upgradeFileName parameter, allowing authenticated attackers to execute arbitrary OS commands on the device, resulting in remote code execution.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.15698 · 96.9th percentile
Published: 2025-07-15T00:00Z

EPSS history

Timeline

15 JUL 00:00Z
Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated command injection vulnerability in the firmware update feature
cvelistv5