CVE-2025-34117

Netcore / Netis Routers RCE via UDP Port 53413 Backdoor

State: Published
Severity: 9.3 Critical
Published: Jul 16, 2025
Updated: Apr 7, 2026
Reserved: Apr 15, 2025

Description

A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. This backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-912 Hidden Functionality
CWE-306 Missing Authentication for Critical Function
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Router firmwareNetcore Technology	Prior to August 2014Affected
Router firmwareNetis	Prior to August 2014Affected

References

https://web.archive.org/web/20140828114943/http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/third-party-advisorytechnical-description
https://www.seebug.org/vuldb/ssvid-90227third-party-advisorytechnical-description
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/misc/netcore_udp_53413_backdoor.rbexploit
https://www.shadowserver.org/what-we-do/network-reporting/netcore-netis-router-vulnerability-scan-report/third-party-advisory
https://vulners.com/metasploit/MSF:EXPLOIT-LINUX-MISC-NETCORE_UDP_53413_BACKDOOR-third-party-advisoryexploit
https://www.vulncheck.com/advisories/netcore-netis-routers-backdoor-rcethird-party-advisory
https://www.exploit-db.com/exploits/43387exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.