What is the CVSS score of CVE-2025-64090?

CVE-2025-64090 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IoT are affected by CVE-2025-64090?

Organizations using This vulnerability face critical risk from CVE-2025-64090, a command injection vulnerability rated CVSS 10.0.

How to fix or mitigate CVE-2025-64090?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

IoT CVE-2025-64090

CRITICAL

Command Injection (CWE-77)

2026-01-09 cert@ncsc.nl

RCE Command Injection IoT Remote Code Execution Tcis 3 Firmware

10.0

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 09, 2026 - 10:15 nvd

CRITICAL 10.0

DescriptionNVD

This vulnerability allows authenticated attackers to execute commands via the hostname of the device.

AnalysisAI

Command injection via the hostname field allowing authenticated code execution with maximum CVSS 10.0 and scope change.

Technical ContextAI

The hostname configuration is passed to a system command without sanitization (CWE-77). The scope change and maximum CVSS suggest the attacker gains control beyond the vulnerable application.

RemediationAI

Apply vendor patches. Sanitize all input used in system commands.

CVE-2025-64090 vulnerability details – vuln.today

Back

IoT CVE-2025-64090

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code