CVE-2025-34117
Published: 16 July 2025
Summary
CVE-2025-34117 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 1.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A remote code execution vulnerability affects multiple Netcore and Netis router models running firmware released before August 2014. The issue stems from an undocumented backdoor that listens on UDP port 53413 and implements a hardcoded authentication mechanism, allowing unauthenticated remote attackers to submit shell commands after authentication. The affected component is the router firmware itself, with exact version boundaries left undocumented in available reporting; certain device models also contain a non-standard implementation of the echo command that can influence successful exploitation.
An unauthenticated remote attacker can send crafted UDP packets to the exposed listener and obtain arbitrary command execution on the device. The backdoor accepts post-authentication shell commands directly, enabling full control over the router without prior credentials or user interaction. Public exploit code, including a Metasploit module, has been available for this vector.
The EPSS score for CVE-2025-34117 reached a peak of 0.6283 with a current value of 0.5688, indicating material exploitation interest after disclosure. References include a Metasploit exploit module, an Exploit-DB entry, and archived reporting from 2014 that first documented the backdoor in Netis routers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21753
Vulnerability details
A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An unauthenticated…
more
remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. This backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Auditing sessions makes it possible to detect access to critical functions without required authentication.
The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
Certification assesses that critical functions have required authentication controls in place.
Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.