CVE-2025-6562
Published: 26 June 2025
Summary
CVE-2025-6562 is a high-severity OS Command Injection (CWE-78) vulnerability in Org (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 22.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-6562 is an OS command injection vulnerability, tracked as CWE-78, that affects specific hybrid DVR models HBF-09KD and HBF-16NK manufactured by Hunt Electronic. The flaw permits remote attackers to supply arbitrary operating-system commands that are then executed on the device, carrying a CVSS 4.0 score of 8.7 that reflects network attack vector, low complexity, and low-privilege requirements.
An attacker who already possesses regular user credentials on an exposed device can inject and run commands without further user interaction, resulting in full control over confidentiality, integrity, and availability of the DVR. Because the vulnerability is reachable over the network, it can be targeted from anywhere an affected unit is accessible.
Public advisories issued by Taiwan’s CERT (TWCERT) detail the issue and are available at the referenced URLs; organizations should consult those documents for vendor-supplied patches or configuration guidance. The associated EPSS score has remained flat at 0.0104 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28752
Vulnerability details
Certain hybrid DVR models (HBF-09KD and HBF-16NK) from Hunt Electronic have an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary OS commands and execute them on the device.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.