CVE-2025-66848
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary commands remotely on affected JD Cloud NAS routers. Attackers can gain full control of vulnerable devices without any credentials. All users of specified JD Cloud router models with vulnerable firmware versions are affected.
💻 Affected Systems
- JD Cloud NAS router AX1800
- JD Cloud NAS router AX3000
- JD Cloud NAS router AX6600
- JD Cloud NAS router BE6500
- JD Cloud NAS router ER1
- JD Cloud NAS router ER2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data theft, malware deployment, and use as pivot point for internal network attacks.
Likely Case
Device compromise leading to credential harvesting, DNS hijacking, botnet recruitment, and network surveillance.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Unauthenticated RCE with CVSS 9.8 suggests trivial exploitation. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - check vendor for updates
Vendor Advisory: https://www.jdcloud.com/cn/
Restart Required: Yes
Instructions:
1. Check JD Cloud website for firmware updates. 2. Download latest firmware for your model. 3. Upload via router admin interface. 4. Apply update and restart router.
🔧 Temporary Workarounds
Network Isolation
allPlace routers behind firewalls with strict inbound filtering
Access Control
allRestrict management interface access to trusted IPs only
🧯 If You Can't Patch
- Immediately isolate vulnerable routers from internet and critical internal networks
- Implement strict network monitoring for suspicious traffic to/from router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface against affected versions listCheck Version:
Check via router web interface or SSH to router if availableVerify Fix Applied:
Verify firmware version is newer than affected versions after update📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in router logs
- Unauthorized access attempts to management interfaces
- Unexpected configuration changes
Network Indicators:
- Unusual outbound connections from router
- Traffic to suspicious IPs from router
- Port scanning originating from router
SIEM Query:
source_ip=router_ip AND (event_type="command_execution" OR dest_port=22,23,80,443,8080,8443 FROM external_ips)