CVE-2025-34117
BaseFortify
Publication date: 2025-07-16
Last updated on: 2025-07-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netcore | router | * |
| netis | router | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
| CWE-912 | The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a remote code execution flaw in multiple Netcore and Netis router models with firmware released before August 2014. It exists because of an undocumented backdoor listener on UDP port 53413 that uses a hardcoded authentication mechanism. An unauthenticated remote attacker can send specially crafted UDP packets to this port to execute arbitrary shell commands on the affected device. Some models have a non-standard echo command implementation, which may influence how the exploit works.
How can this vulnerability impact me? :
This vulnerability allows an unauthenticated remote attacker to execute arbitrary commands on the affected router, potentially taking full control of the device. This can lead to unauthorized access, disruption of network services, interception or manipulation of network traffic, and further compromise of connected systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by scanning your network devices for open UDP port 53413, which is used by the undocumented backdoor listener. Using tools like nmap, you can run the command: nmap -sU -p 53413 <target-ip>. Additionally, monitoring for unusual UDP traffic on port 53413 or attempts to send specially crafted UDP packets to this port may indicate exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or blocking UDP port 53413 on your network devices and firewalls to prevent remote access to the backdoor listener. If possible, update the firmware of affected Netcore and Netis routers to versions released after August 2014 or contact the vendor for patches or guidance. Restricting network access to the affected devices and monitoring for suspicious UDP traffic on port 53413 are also recommended.