What is CVE-2025-34117?

CVE-2025-34117 is a vulnerability in Netcore Technology Router Firmware, classified under OS Command Injection. Published 2025-07-16.

Is CVE-2025-34117 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Netcore Technology Router Firmware

CVE-2025-34117

A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. This backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.

Vulnerability class: Command Injection (OS Command Injection)

Published 2025-07-16 · last modified 2026-06-17.

EPSS exploit prediction

EPSS: 0.274 (98.0th percentile), scored 2026-09-29.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.199 · newest: 0.274 · change: +0.075

Affected products

Netcore Technology Router Firmware — versions Prior to August 2014
Netis Router Firmware — versions Prior to August 2014

Weakness classification (CWE)

Public proof-of-concept exploits

rapid7/metasploit-framework

References

web.archive.org/web/20140828114943/http://blog.trendmicro.com/trendlabs-securit… (technical-description, third-party-advisory)
www.seebug.org/vuldb/ssvid-90227 (technical-description, third-party-advisory)
raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/l… (exploit)
www.shadowserver.org/what-we-do/network-reporting/netcore-netis-router-vulnerab… (third-party-advisory)
vulners.com/metasploit/MSF:EXPLOIT-LINUX-MISC-NETCORE_UDP_53413_BACKDOOR- (exploit, third-party-advisory)
www.vulncheck.com/advisories/netcore-netis-routers-backdoor-rce (third-party-advisory)
www.exploit-db.com/exploits/43387 (exploit)

Frequently asked questions

What is CVE-2025-34117?: CVE-2025-34117 is a vulnerability in Netcore Technology Router Firmware, classified under OS Command Injection. Published 2025-07-16.
Is CVE-2025-34117 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.