CVE-2025-66848

JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.5.1.r4518 and earlier) contain an unauthorized remote command execution vulnerability.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://jd.com	Not Applicable
https://www.notion.so/JD-Cloud-Unauth-RCE-2d22b76e8e0c802c975bf186b208d0c2	Permissions Required
https://www.jdcloud.com/cn/	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:jdcloud:ax1800_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:jdcloud:ax1800:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:jdcloud:ax3000_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:jdcloud:ax3000:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:jdcloud:ax6600_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:jdcloud:ax6600:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:jdcloud:be6500_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:jdcloud:be6500:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:jdcloud:er1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:jdcloud:er1:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:jdcloud:er2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:jdcloud:er2:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-12-30 17:15

Updated : 2026-01-09 19:57

NVD link : CVE-2025-66848

Mitre link : CVE-2025-66848

CVE.ORG link : CVE-2025-66848

JSON object : View

Products Affected

jdcloud

be6500_firmware
ax6600
er2
be6500
ax6600_firmware
er1
er1_firmware
er2_firmware
ax1800
ax1800_firmware
ax3000_firmware
ax3000

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-66848", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-12-30T17:15:43.357", "references": [{"url": "http://jd.com", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://www.notion.so/JD-Cloud-Unauth-RCE-2d22b76e8e0c802c975bf186b208d0c2", "tags": ["Permissions Required"], "source": "cve@mitre.org"}, {"url": "https://www.jdcloud.com/cn/", "tags": ["Product"], "source": "nvd@nist.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.5.1.r4518 and earlier) contain an unauthorized remote command execution vulnerability."}], "lastModified": "2026-01-09T19:57:09.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:jdcloud:ax1800_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B97F646-335D-4D9E-AC5A-B2FE054DDC92", "versionEndIncluding": "4.3.1.r4308"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:jdcloud:ax1800:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "96CF5056-14B0-4759-9AB7-BBCC6C45F6D1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:jdcloud:ax3000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35803C35-4BCB-424B-BB99-AE7ED3E625E5", "versionEndIncluding": "4.3.1.r4318"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:jdcloud:ax3000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E2FD6853-715D-439D-9E04-0BA88A1534BE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:jdcloud:ax6600_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AAD2DA42-EBF5-46D3-8D2C-C1E1C9BFE345", "versionEndIncluding": "4.5.1.r4533"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:jdcloud:ax6600:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F6C4FCF2-BA40-43F2-ADB1-C8A58052600B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:jdcloud:be6500_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF51D33D-440D-4DD5-A4A4-8FBF832A6DDC", "versionEndIncluding": "4.4.1.r4308"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:jdcloud:be6500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FEF4502D-C7B2-481F-9835-D9E50B3E3E82"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:jdcloud:er1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50941751-AB04-4567-8BC9-C6B326C8F651", "versionEndIncluding": "4.5.1.r4518"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:jdcloud:er1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "81E9D9ED-2232-4D73-89D8-BD344857CBD7"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:jdcloud:er2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F69AF1F-4ADA-4F7A-9142-0DB76DE80FD8", "versionEndIncluding": "4.5.1.r4518"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:jdcloud:er2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2513752-2EBE-41C1-9489-AF0464138311"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}