RCE in Diviotec Nbf232p
CVE-2025-5113
The Diviotec professional series exposes a web interface. One endpoint is vulnerable to arbitrary command injection and hardcoded passwords are used.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.078 (94.0th percentile) — read the EPSS interpretation.
Affected products
- Diviotec Nbf232p — versions 0
- Diviotec Nbf233p — versions 0
- Diviotec Nbr222p — versions 0
- Diviotec Nbr222pv — versions 0
- Diviotec Nbr224p — versions 0
- Diviotec Nbr225p — versions 0
- Diviotec Nbr226p — versions 0
- Diviotec Ndr252p — versions 0
- Diviotec Ndr255p — versions 0
Weakness classification (CWE)
References
- research@onekey.com (third-party-advisory)