RCE in Netcore Technology Router Firmware
CVE-2025-34117
A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. This backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.201 (97.2th percentile) — read the EPSS interpretation.
Affected products
- Netcore Technology Router Firmware — versions Prior to August 2014
- Netis Router Firmware — versions Prior to August 2014
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (technical-description, third-party-advisory)
- disclosure@vulncheck.com (technical-description, third-party-advisory)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com (exploit, third-party-advisory)
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com (exploit)
Frequently asked questions
- What is CVE-2025-34117?
- CVE-2025-34117 is a vulnerability in Netcore Technology Router Firmware, classified under OS Command Injection. Published 2025-07-16.
- Is CVE-2025-34117 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.