CVE-2025-6522CWE-77

TrendMakers Sight Bulb Pro Command Injection

Medium · published June 27, 2025

CVSS v4.0

5.2

EPSS

Percentile

12.8

In the wild

Unconfirmed

What it is

Unauthenticated users on an adjacent network with the Sight Bulb Pro can

run shell commands as root through a vulnerable proprietary TCP

protocol available on Port 16668. This vulnerability allows an attacker

to run arbitrary commands on the Sight Bulb Pro by passing a well formed

JSON string.

The record

Technical detail

CVSS v4.0: 5.2 · MEDIUM
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS: 0.00228 · 12.8th percentile
Weakness: CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published: 2025-06-27T17:09Z

EPSS history

Timeline