Nexxt NCM-X1800 up to 1.2.7 Web Management Interface /web/um_ping_set.cgi Ping_host_text command injection

Summaryinfo

A vulnerability labeled as critical has been found in Nexxt NCM-X1800 up to 1.2.7. The affected element is an unknown function of the file /web/um_ping_set.cgi of the component Web Management Interface. The manipulation of the argument Ping_host_text results in command injection. This vulnerability is known as CVE-2025-52377. It is possible to launch the attack remotely. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in Nexxt NCM-X1800 up to 1.2.7. It has been classified as critical. Affected is an unknown part of the file /web/um_ping_set.cgi of the component Web Management Interface. The manipulation of the argument Ping_host_text with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary commands on the device. The vulnerability is present in the web management interface's ping and traceroute functionality, specifically in the /web/um_ping_set.cgi endpoint. The application fails to properly sanitize user input in the `Ping_host_text` parameter before passing it to the underlying system command, allowing attackers to inject and execute arbitrary shell commands as the root user.

The advisory is available at github.com. This vulnerability is traded as CVE-2025-52377 since 06/16/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details and a public exploit are known. This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

The exploit is shared for download at github.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-21450). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Nexxt

Name

• NCM-X1800

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion