CVE-2025-66848 Command injection in n/a
Attackers can execute arbitrary commands remotely on JD Cloud NAS routers without authentication, potentially compromising the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66848?
CVE-2025-66848 is a critical command injection vulnerability in n/a, published on 30 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.5.1.r4518 and earlier) contain an unauthorized remote command execution vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2025-66848?
It affects 6 products.
Products include Jdcloud Ax1800 Firmware, Jdcloud Ax3000 Firmware, Jdcloud Ax6600 Firmware, Jdcloud Be6500 Firmware, Jdcloud Er1 Firmware, Jdcloud Er2 Firmware.
How do I fix CVE-2025-66848?
No fix has been published for CVE-2025-66848 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-66848 being exploited?
There is no known exploitation of CVE-2025-66848 in the wild and no public exploit code.
Sources
Also known as GHSA-mrp8-v53m-q9q9.