What is the CVSS score of CVE-2025-63624?

CVE-2025-63624 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2025-63624?

Yes, a public proof-of-concept exploit is available for CVE-2025-63624. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-63624?

Within 24 hours: Identify all instances of the affected IoT platform (v1.0) in your environment and isolate them from production networks if possible; disable remote access to imei_list.aspx via firewall rules. Within 7 days: Implement WAF rules to block SQL injection patterns targeting the vulnerable endpoint; conduct forensic review of access logs for exploitation attempts; contact Shandong Kede Electronics for patch availability and timeline. Within 30 days: Deploy patched version immediately upon release; perform full security assessment of water meter infrastructure; implement network segmentation to limit lateral movement from compromised devices.

IoT CVE-2025-63624

CRITICAL

SQL Injection (CWE-89)

2026-02-03 cve@mitre.org

SQLi Industrial IoT Iot Smart Water Meter Firmware

9.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 9.8 with PoC. IoT infrastructure monitoring platforms manage utility data. SQL injection could allow manipulation of water consumption records or disruption of monitoring.
Exploit ScenarioDerived	An attacker exploits the SQL injection to access water consumption data, modify billing records, or disable monitoring alerts for water infrastructure.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the industrial monitoring database.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:54 CVSS 9.8

SQL injection in IoT water meter monitoring platform enables infrastructure database compromise.

RemediationAI

Apply patches. Isolate IoT monitoring platforms from public networks.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The Kede Electronics smart water meter monitoring platform v1.0 has a CWE-89 SQL injection that allows attackers to extract and modify data in the monitoring database.

Know when IoT gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 11, 2026 - 19:25 vuln.today

Public exploit code

CVE Published

Feb 03, 2026 - 18:16 nvd

CRITICAL 9.8

DescriptionCVE.org

SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows a remote attacker to execute arbitrary code via the imei_list.aspx file.

Executive ViewAI

Why It Matters

A critical SQL injection vulnerability (CVSS 9.8) in Shandong Kede Electronics smart water meter monitoring systems allows unauthenticated remote attackers to execute arbitrary code. Organizations operating this platform face immediate risk of complete system compromise, data breach, and operational disruption across water management infrastructure.

Business Impact: Severe

Compensating Controls

Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to imei_list.aspx; restrict network access to the vulnerable endpoint using firewall ACLs; disable or restrict the imei_list.aspx functionality if operationally feasible; segment IoT water meter devices on isolated network subnets with egress filtering; enable enhanced logging and intrusion detection for this application; consider running the platform behind a reverse proxy with input validation enforcement.

Threat Intelligence Overview

EPSS Score

0.2%

Top 52% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

SQL Injection HIGH

SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.

Affected Products (CPE)CVE.org

cpe:2.3:o:sdkede:iot_smart_water_meter_firmware:1.0:*:*:*:*:*:*:*

More in IoT

View all

CVE-2025-45988 CRITICAL Act Now POC

9.8 Jun 13

A command injection vulnerability (CVSS 9.8). Risk factors: public PoC available.

CVE-2026-29128 CRITICAL Act Now POC

10.0 Mar 05

Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.

CVE-2025-65294 CRITICAL Act Now POC

9.8 Dec 10

Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stem

CVE-2026-101076 CRITICAL Act Now POC

9.3 Sep 28

An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e

CVE-2026-101077 CRITICAL Act Now POC

9.3 Sep 28

Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab

CVE-2026-101075 CRITICAL Act Now POC

9.3 Sep 28

Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary

CVE-2026-101072 CRITICAL Act Now POC

9.3 Sep 28

Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can

CVE-2026-101039 CRITICAL Act Now POC

9.3 Sep 28

A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r

CVE-2026-25139 CRITICAL Act Now POC

9.1 Feb 04

RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure o

CVE-2026-102792 HIGH This Week POC

8.5 Sep 29

Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege aut

CVE-2026-102793 HIGH This Week POC

8.5 Sep 29

Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operatin

CVE-2026-101261 HIGH This Week POC

8.5 Sep 28

OS command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) allows an attacker who can reach the

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

9.8

CVE-2019-7481 HIGH POC

7.5

CVE-2025-57819 CRITICAL POC

10.0

CVE-2017-8917 CRITICAL POC

9.8

CVE-2024-27956 CRITICAL POC

9.9

CVE-2014-3704 HIGH POC

7.5

CVE-2016-2555 CRITICAL POC

9.8

CVE-2016-8582 CRITICAL POC

9.8

Same technique SQLi

View all

CVE-2013-0333 HIGH POC

7.5

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back