CVE-2025-66620
Published: 07 January 2026
Summary
CVE-2025-66620 is a high-severity Command Shell in Externally Accessible Directory (CWE-553) vulnerability in Columbiaweather Weather Microserver Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Shell (T1505.003); ranked at the 16.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-7 (Unsuccessful Logon Attempts) and CM-7 (Least Functionality).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the webshell vulnerability through patching or updates to eliminate unlimited login attempts and sudo access.
Directly counters unlimited login attempts to the webshell by enforcing lockout after a defined number of unsuccessful logons.
Prevents exploitation by configuring the system to disable or remove unused webshells and non-essential functions granting sudo rights.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unused webshell with unlimited login attempts directly enables T1505.003 (Web Shell) and T1110 (Brute Force); granted sudo rights map to T1548.003; limited shell access for reverse shells/persistence maps to T1059.004.
NVD Description
An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroServer can gain limited shell access, enabling persistence through reverse shells, and the ability to modify or…
more
remove data stored in the file system.
Deeper analysisAI
CVE-2025-66620 is a vulnerability in MicroServer involving an unused webshell that permits unlimited login attempts and grants sudo rights on certain files and directories. This issue, associated with CWE-553, affects the MicroServer component and carries a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts with low attack complexity and privileges required from an adjacent network.
An attacker with admin access to MicroServer can exploit this vulnerability to obtain limited shell access. This enables persistence mechanisms such as reverse shells, along with the capability to modify or remove data stored in the file system.
Mitigation details are outlined in advisories including ICSA-26-006-01 from CISA (https://www.cisa.gov/news-events/ics-advisories/icsa-26-006-01) and the corresponding CSAF document (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-006-01.json). The vulnerability was published on 2026-01-07.
Details
- CWE(s)