CVE-2025-52377 Command injection in n/a
Authenticated attackers can execute arbitrary shell commands as root via the web management interface's ping functionality in Nexxt Solutions Mesh Routers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-52377?
CVE-2025-52377 is a medium-severity command injection vulnerability in n/a, published on 15 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary commands on the device. The vulnerability is present in the web management interface's ping and traceroute functionality, specifically in the /web/um_ping_set.cgi endpoint. The application fails to properly sanitize user input in the `Ping_host_text` parameter before passing it to the underlying system command, allowing attackers to inject and execute arbitrary shell commands as the root user.
Weakness: CWE-77
Which versions are affected by CVE-2025-52377?
How do I fix CVE-2025-52377?
No fix has been published for CVE-2025-52377 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-52377 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-52377 exists.
Sources
Also known as GHSA-xmg9-ggwm-84mg.