CVE-2025-8890
Authenticated RCE in SDMC NE6037 router
- State
- Published
- Severity
- 9.3 Critical
- Published
- Nov 27, 2025
- Updated
- Mar 18, 2026
- Reserved
- Aug 12, 2025
Description
Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to a shell command injection attacks. In order to exploit this vulnerability, an attacker has to log in to the router's administrative portal, which by default is reachable only via LAN ports.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | CERT-PL |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
NE6037SDMC |
|
References
- https://cert.pl/en/posts/2025/11/CVE-2025-8890third-party-advisory
- https://www.securitum.com/cve-2025-8890.htmltechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.