CVE-2025-4010
Arbitrary Command Injection in Netcom NTC-6200 & NWL-222
- State
- Published
- Severity
- 8.6 High
- Published
- Jun 2, 2025
- Updated
- Jun 2, 2025
- Reserved
- Apr 27, 2025
Description
The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoints of the web interface are vulnerable to arbitrary command injection and use insecure hardcoded passwords. Remote authenticated attackers can gain arbitrary code execution with elevated privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | ONEKEY |
Weaknesses
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected Products
| Product | Versions |
|---|---|
NTC 6200Netcomm |
|
NWL-222Netcomm |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.