What is CVE-2025-66848?

CVE-2025-66848 is a critical-severity vulnerability in Jdcloud Ax1800, classified under Code Injection. CVSS score: 9.8/10. Published 2025-12-30.

How severe is CVE-2025-66848?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Jdcloud Ax1800

CVE-2025-66848

JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.5.1.r4518 and earlier) contain an unauth…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.009 (56.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Jdcloud Ax1800
Jdcloud Ax1800_firmware
Jdcloud Ax3000
Jdcloud Ax3000_firmware
Jdcloud Ax6600
Jdcloud Ax6600_firmware
Jdcloud Be6500
Jdcloud Be6500_firmware
Jdcloud Er1
Jdcloud Er1_firmware

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (Not Applicable)
cve@mitre.org (Permissions Required)
nvd@nist.gov (Product)

Frequently asked questions

What is CVE-2025-66848?: CVE-2025-66848 is a critical-severity vulnerability in Jdcloud Ax1800, classified under Code Injection. CVSS score: 9.8/10. Published 2025-12-30.
How severe is CVE-2025-66848?: Critical severity. CVSS v3 base score is 9.8 out of 10.