CVE-2025-52377

Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary commands on the device. The vulnerability is present in the web management interface's ping and traceroute functionality, specifically in the /web/um_ping_set.cgi endpoint. The application fails to properly sanitize user input in the `Ping_host_text` parameter before passing it to the underlying system command, allowing attackers to inject and execute arbitrary shell commands as the root user.

• CWE-77

• https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits
• https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits/blob/main/CVE-2025-52377/writeup.md

Published

Jul 15, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52367Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC …5.4
• CVE-2025-5237The Target Video Easy Publish plugin for WordPress is vulner…6.4
• CVE-2025-52372An issue in hMailServer v.5.8.6 allows a local attacker to o…5.1
• CVE-2025-52373Use of hardcoded cryptographic key in BlowFish.cpp in hMailS…4.6
• CVE-2025-52374Use of hardcoded cryptographic key in Encryption.cs in hMail…4.6
• CVE-2025-52376An authentication bypass vulnerability in the /web/um_open_t…9.8
• CVE-2025-52378Cross-Site Scripting (XSS) vulnerability in Nexxt Solutions …5.4
• CVE-2025-52379Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and b…5.4
• CVE-2025-5238The YITH WooCommerce Wishlist plugin for WordPress is vulner…6.4
• CVE-2025-52385An issue in Studio 3T v.2025.1.0 and before allows a remote …9.8
• CVE-2025-52386CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injecti…5.4
• CVE-2025-52389An Insecure Direct Object Reference (IDOR) in Envasadora H2O…8.8