CVE-2025-66848

JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier)…

Critical · published December 30, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
64.4
In the wild
Unconfirmed
What it is

🚨 A critical remote command execution vulnerability is lurking in JD Cloud NAS routers, just waiting for someone to take advantage of it! 🔥 Think of this vulnerability as leaving the gates of your tech fortress wide open; any intruder can stroll in and take control, like an uninvited guest crashing a party with no security in sight. An attacker could potentially execute commands remotely, gaining full control over your router and, by extension, your entire network. This could lead to unauthorized access to sensitive data, changes in configurations, and even a complete takeover of connected devices. It's absolutely devastating!

Put simply

Think of this vulnerability as leaving the gates of your tech fortress wide open; any intruder can stroll in and take control, like an uninvited guest crashing a party with no security in sight. This vulnerability allows an unauthorized attacker to execute commands on affected JD Cloud NAS routers due to insufficient authentication checks, letting them manipulate the system as they please.

What to do

An attacker could potentially execute commands remotely, gaining full control over your router and, by extension, your entire network. This could lead to unauthorized access to sensitive data, changes in configurations, and even a complete takeover of connected devices. It's absolutely devastating! Immediately update to the latest firmware version for your router model: AX1800 (4.3.1.r4309 or later), AX3000 (4.3.1.r4319 or later), AX6600 (4.5.1.r4534 or later), BE6500 (4.4.1.r4309 or later), ER1 (4.5.1.r4519 or later), ER2 (4.5.1.r4519 or later). Ensure that you also review your network security configurations and consider additional protections against external threats. You've got this! Patch those devices and lock down your network like the security hero you are! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01063 · 64.4th percentile
Published
2025-12-30T00:00Z
EPSS history
Timeline
  • 30 DEC 00:00Z
    JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier)…
    cvelistv5