CVE-2025-43953

HighRCE

Published: 22 September 2025

Published

22 September 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0013 31.4th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-43953 is a high-severity Command Injection (CWE-77) vulnerability in 2Wcom (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents command injection vulnerabilities by requiring validation of inputs in the ping and traceroute fields of the web interface.

SI-2 Flaw Remediation good match

prevent

Addresses the specific flaw in IP-4c 2.16 by mandating timely remediation through vendor patches or updates.

AC-6 Least Privilege partial match

prevent

Limits the impact of successful command injection by ensuring web interface processes and executed commands do not run with unnecessary root privileges.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Command injection in the device's web interface directly enables exploitation of a public-facing application for RCE as root.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

In 2wcom IP-4c 2.16, the web interface allows admin and manager users to execute arbitrary code as root via a ping or traceroute field on the TCP/IP screen.

Deeper analysisAI

CVE-2025-43953 is a command injection vulnerability (CWE-77) affecting the 2wcom IP-4c device running version 2.16. The issue resides in the web interface, specifically the ping and traceroute fields on the TCP/IP screen, which allow admin and manager users to execute arbitrary code with root privileges. The vulnerability received a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2025-09-22.

An attacker with admin or manager access to the web interface can exploit this vulnerability by injecting malicious commands into the ping or traceroute input fields, leading to remote code execution as root on the device. The CVSS metrics indicate network accessibility with low attack complexity, no privileges required in some interpretations, but user interaction needed, potentially enabling scenarios where an attacker tricks an authorized user into processing a crafted input.

For mitigation details, refer to the vendor advisory at https://2wcom.com and the research repository at https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-43953, which may include patch information or workarounds.