CVE-2025-4010

The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoints of the web interface are vulnerable to arbitrary command injection and use insecure hardcoded passwords. Remote authenticated attackers can gain arbitrary code execution with elevated privileges.

CVSS

No CVSS.

References

Link	Resource
https://www.onekey.com/resource/security-advisory-remote-command-execution-on-netcomm-ntc-6200-and-nwl-222

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Las series Netcom NTC 6200 y NWL 222 exponen una interfaz web que los operadores pueden configurar. Varios endpoints de la interfaz web son vulnerables a la inyección de comandos arbitrarios y utilizan contraseñas inseguras. Atacantes remotos autenticados pueden ejecutar código arbitrario con privilegios elevados.

02 Jun 2025, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-02 07:15

Updated : 2026-04-15 00:35

NVD link : CVE-2025-4010

Mitre link : CVE-2025-4010

CVE.ORG link : CVE-2025-4010

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2025-4010", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "research@onekey.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-02T07:15:21.833", "references": [{"url": "https://www.onekey.com/resource/security-advisory-remote-command-execution-on-netcomm-ntc-6200-and-nwl-222", "source": "research@onekey.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "research@onekey.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple\u00a0endpoints of the web interface are vulnerable to arbitrary command injection and use insecure hardcoded passwords. Remote authenticated attackers can gain arbitrary code execution with elevated privileges."}, {"lang": "es", "value": "Las series Netcom NTC 6200 y NWL 222 exponen una interfaz web que los operadores pueden configurar. Varios endpoints de la interfaz web son vulnerables a la inyecci\u00f3n de comandos arbitrarios y utilizan contrase\u00f1as inseguras. Atacantes remotos autenticados pueden ejecutar c\u00f3digo arbitrario con privilegios elevados."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "research@onekey.com"}