Curo UC300 CVE-2025-57457
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin-panel credentials
-
DeliveryAccess network config "IP Addr" field
-
ExploitInject shell metacharacters into parameter
-
ExecutionCommand executed by device shell
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated access to the Curo UC300 Admin panel (CVSS PR:L) and the ability to submit the "IP Addr" parameter - the specific injectable field on firmware 5.42.1.7.1.63R1. No user interaction from a victim is needed (UI:N). Limiting factors: the attacker must already hold valid low-privileged admin-panel credentials, and only the named firmware build is confirmed affected. Note an unresolved conflict - the description states "local attackers" while the CVSS vector is AV:N (network); if the local reading is correct, the attacker also needs local/adjacent access to the management interface, which further constrains realistic exploitation and should be confirmed with the vendor. |
| Impact | The provided CVSS 3.1 vector rates this 8.8 (High) with AV:N/AC:L/PR:L/UI:N and full C/I/A impact, implying a network-reachable admin function requiring only low-privileged authentication. However, the description explicitly says "local attackers," which conflicts with the AV:N (network) rating - this discrepancy should be verified with the vendor, as it materially changes exposure (network-exploitable admin panel vs. local-only access). EPSS is low-to-moderate (1.15%, 63rd percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; the presence of a public GitHub PoC repository raises practical exploitability but PoC availability is distinct from in-the-wild use. Net: a genuine high-impact issue for anyone running the affected build, but the requirement for admin-panel authentication and the niche device footprint temper real-world urgency compared to an unauthenticated, widely deployed target. |
| Exploit ScenarioDerived | An attacker who has obtained low-privileged admin-panel credentials (e.g., default, reused, or phished) navigates to the network-configuration form and enters a payload such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 05, 2026
OS command injection in the Curo UC300 (firmware 5.42.1.7.1.63R1) unified communications device lets an authenticated attacker with admin-panel access run arbitrary operating-system commands by injecting shell metacharacters into the "IP Addr" parameter. Successful exploitation yields full command execution on the underlying device (high confidentiality, integrity, and availability impact). A public GitHub repository referenced by NVD indicates publicly available exploit code exists, though the flaw is not listed in CISA KEV and its EPSS probability is modest (1.15%, 63rd percentile).
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed firmware version is provided in the input, so the primary mitigation is to restrict access to the UC300 Admin panel: place the management interface on an isolated management VLAN, block it from untrusted networks, and enforce strong, unique admin credentials plus MFA if supported, since exploitation requires low-privileged admin-panel authentication. Where feasible, avoid exposing the device web/management interface to the internet and monitor the "IP Addr" field and network-utility functions for anomalous input, accepting that these controls reduce but do not eliminate risk from an authenticated insider. Contact Curo/CommScope for a patched firmware release and consult the referenced GitHub repository (https://github.com/restdone/CVE-2025-57457/tree/main) to understand exploit specifics; do not rely on any invented version number, as none was supplied.
Affected ProductsAI
The Curo UC300 unified-communications device running firmware version 5.42.1.7.1.63R1 is the only build named as affected; other versions are neither confirmed vulnerable nor confirmed safe from the available data. No CPE strings were provided to enumerate exact configurations, and no vendor advisory URL was supplied - the sole reference is a third-party GitHub repository (https://github.com/restdone/CVE-2025-57457/tree/main) cited by NVD, which appears to host proof-of-concept material rather than an official fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Curo UC300 is a unified-communications / VoIP endpoint whose web-based Admin panel accepts an "IP Addr" input that is passed to an underlying OS command without adequate sanitization. This is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) failure: user-controlled text intended to be an IP address is concatenated into a shell invocation (likely a network utility such as ping or a network-config routine), so shell metacharacters (;, |, `, $()) break out of the intended argument and execute attacker-supplied commands with the privileges of the web/management process. No CPE strings were supplied in the input, so the only firmware confirmed affected is the exact build named in the description, 5.42.1.7.1.63R1.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Admin-panel injection requires low-privileged authentication (PR:L); network-reachable management interface justifies AV:N per the supplied vector, and command execution yields full C/I/A impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter.
Executive ViewAI
Curo UC300 unified communications devices with firmware 5.42.1.7.1.63R1 contain an OS command injection vulnerability allowing full command execution and system compromise. Publicly available exploit code exists for this vulnerability. Organizations operating these devices face risk of unauthorized system access, voice communications disruption, and data exfiltration, particularly if administrative accounts are compromised or misused internally.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Firewall rules restricting admin panel access to authorized administration networks; (2) Multi-factor authentication required for all administrative accounts; (3) Comprehensive audit logging with alerting on suspicious configuration changes and command patterns in IP address parameters; (4) Reduce number of users with admin privileges to documented business minimum; (5) Network segmentation isolating UC300 devices from critical business systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB