CVE-2025-63624
SQL Injection in Shandong Kede IoT Meter Enables Remote Code Execution
Publication date: 2026-02-03
Last updated on: 2026-02-11
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sdkede | iot_smart_water_meter_firmware | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "To mitigate the SQL Injection vulnerability in the Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v1.0, immediate steps include restricting or disabling access to the vulnerable imei_list.aspx page, especially the 'txtJZRQ' parameter that is exploited."}, {'type': 'paragraph', 'content': "Additionally, consider disabling or restricting the 'xp_cmdshell' stored procedure in the backend database, as it is leveraged by attackers to execute arbitrary system commands."}, {'type': 'paragraph', 'content': "Implement input validation and sanitization to prevent injection of malicious payloads, and monitor network logs for suspicious activities such as unusual 'ping' commands that may indicate exploitation attempts."}, {'type': 'paragraph', 'content': 'Finally, apply any available patches or updates from the vendor addressing this vulnerability as soon as they become available.'}] [1]
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2025-63624 is a SQL Injection vulnerability in the IoT smart water meter monitoring platform version 1.0 developed by Shandong Kede Electronics Co., Ltd. The flaw exists in the "txtJZRQ" parameter of the unauthorized page /kddz/imei_list.aspx. An attacker can exploit this vulnerability by injecting a specially crafted payload that bypasses filters designed to block command execution, such as altering the case of the string "EXEC" to "eXeC". This allows the attacker to execute arbitrary system commands on the server, effectively achieving unauthorized remote code execution.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can have severe impacts as it allows unauthorized remote attackers to execute arbitrary commands on the server hosting the IoT smart water meter monitoring platform. This could lead to full system compromise, data theft, disruption of service, or further attacks within the network. Attackers can confirm successful exploitation by executing commands like "ping" to generate DNS logs, indicating control over the system.'}] [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the vulnerable endpoint /kddz/imei_list.aspx with specially crafted payloads targeting the "txtJZRQ" parameter to check for SQL injection and remote code execution.'}, {'type': 'paragraph', 'content': 'One detection method involves sending a payload that attempts to execute system commands via the database\'s xp_cmdshell stored procedure, bypassing filters by altering the case of the string "EXEC" to "eXeC."'}, {'type': 'list_item', 'content': 'Send a request to /kddz/imei_list.aspx with a payload in the txtJZRQ parameter that tries to execute a command like "ping" to an attacker-controlled domain to generate DNS logs, confirming code execution.'}, {'type': 'list_item', 'content': 'Example command payload: use a case-altered EXEC keyword (e.g., eXeC) to bypass filters and invoke xp_cmdshell to run system commands.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know