CVE-2025-67113 in SCE4255W
Summary
by MITRE • 03/19/2026
OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into the firmware upgrade pipeline.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/24/2026
This vulnerability represents a critical operating system command injection flaw in the CWMP client component of Small Cell Sercomm SCE4255W modem firmware. The vulnerability exists within the /ftl/bin/cwmp binary which processes TR-069 protocol communications from the ACS (Auto Configuration Server) endpoint. The flaw occurs when the firmware fails to properly sanitize or escape user-supplied input from the TR-069 Download URL parameter, allowing attackers to inject malicious commands that are subsequently executed with root privileges. This represents a severe privilege escalation vulnerability that directly impacts the device's security posture and allows full system compromise.
The technical implementation of this vulnerability stems from improper input validation within the firmware upgrade pipeline where the TR-069 Download URL parameter is directly passed to system commands without adequate sanitization. According to CWE-77, this manifests as a command injection vulnerability where attacker-controlled data flows into an operating system command execution context. The vulnerability is particularly dangerous because it operates at the root level within the firmware environment, allowing attackers to execute arbitrary system commands with the highest possible privileges. The attack vector requires remote access through the ACS endpoint, which means an attacker controlling the ACS server can leverage this flaw to gain complete control over the affected device.
The operational impact of this vulnerability is severe and multifaceted, affecting both device security and network infrastructure. An attacker with control over the ACS endpoint can execute commands such as modifying firmware images, installing backdoors, accessing network credentials, or redirecting traffic through the device. This vulnerability effectively provides a complete compromise of the device's operational integrity and can be leveraged for further attacks within the network. The affected firmware version DG3934v3@2308041842 represents a specific vulnerable release that requires immediate attention, as the flaw exists within the core firmware upgrade mechanism that is essential for device management and security updates.
Mitigation strategies for this vulnerability must address both immediate remediation and long-term security improvements. The primary solution involves applying firmware updates from the vendor that properly sanitize input parameters and implement proper command escaping mechanisms. Organizations should also consider network segmentation and monitoring of TR-069 traffic to detect anomalous behavior patterns that might indicate exploitation attempts. According to ATT&CK framework, this vulnerability maps to T1059.001 (Command and Scripting Interpreter) and T1068 (Local Privilege Escalation), indicating that exploitation would involve command execution and privilege escalation techniques. Network administrators should implement strict access controls on ACS endpoints and consider disabling unnecessary TR-069 functionality when not actively required for device management. The vulnerability highlights the critical importance of input validation in embedded firmware systems and the need for robust security testing throughout the development lifecycle.