CVE-2025-8890CWE-78command-injection

CVE-2025-8890

published November 27, 2025

CVSS
9.3
EPSS
1%
Percentile
73.1
In the wild
Unconfirmed
What it is

Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to a shell command injection attacks.

In order to exploit this vulnerability, an attacker has to log in to the router's administrative portal, which by default is reachable only via LAN ports.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.01449 · 73.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-11-27T19:15Z
References (3)
https://cert.pl/en/posts/2025/11/CVE-2025-8890 · [email protected]https://www.securitum.com/cve-2025-8890.html · [email protected]https://www.securitum.com/cve-2025-8890.html · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 NOV 13:42Z
    Authenticated RCE in SDMC NE6037 router
    cvelistv5