What is the CVSS score of CVE-2025-66848?

CVE-2025-66848 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of JD Cloud Router are affected by CVE-2025-66848?

JD Cloud NAS-series routers (AX1800, AX3000, AX6600, BE6500, ER1/ER2) are vulnerable to unauthenticated remote command execution that grants attackers complete device control.

How to fix or mitigate CVE-2025-66848?

Within 24 hours: Inventory all affected JD Cloud NAS-series routers and restrict external network access via firewall rules; disable remote management interfaces where operationally feasible. Within 7 days: Implement network segmentation to isolate router management traffic and limit lateral movement potential; establish daily monitoring of router logs and configuration changes; contact JD Cloud for patch availability estimates. Within 30 days: Develop and execute replacement strategy for affected router models with patched alternatives; begin procurement of devices from vendors with established security update lifecycles.

JD Cloud Router CVE-2025-66848

CRITICAL

Code Injection (CWE-94)

2025-12-30 cve@mitre.org

Code Injection RCE Ax1800 Firmware Ax3000 Firmware Ax6600 Firmware Be6500 Firmware Er1 Firmware Er2 Firmware

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthorized network-reachable command injection with no auth or interaction gives AV:N/AC:L/PR:N/UI:N, and full device compromise yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:43 vuln.today

DescriptionCVE.org

JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.5.1.r4518 and earlier) contain an unauthorized remote command execution vulnerability.

AnalysisAI

Remote command execution in JD Cloud NAS-series routers (AX1800, AX3000, AX6600, BE6500, ER1 and ER2 firmware) allows unauthenticated network attackers to inject and run arbitrary OS commands on the device. The flaw is rated CVSS 9.8 with an unauthenticated network vector, and while no public exploit has been identified, its EPSS of 1.01% (59th percentile) reflects moderate near-term exploitation likelihood. Successful abuse yields full control of the router, making it a pivot point into the internal network.

Technical ContextAI

The affected devices are consumer/SOHO Wi-Fi and NAS routers manufactured under the JD Cloud (Jingdong) brand, identified in NVD CPE data as jdcloud ax1800_firmware, ax3000_firmware, ax6600_firmware, be6500_firmware, er1_firmware and er2_firmware (operating-system-class CPEs). The root cause class is CWE-94 (Improper Control of Generation of Code / Code Injection), which in embedded router firmware typically stems from a web-management or backend service passing attacker-controlled input into a shell or command interpreter without sanitization. Because the CPEs are firmware-level, the vulnerability resides in the device operating system itself rather than a third-party add-on, and the vendor tags (RCE, Code Injection) corroborate a command-injection primitive reachable over the network.

RemediationAI

No vendor-released patch version is identified in the available data, so upgrade to firmware newer than the listed vulnerable builds (AX1800 > 4.3.1.r4308, AX3000 > 4.3.1.r4318, AX6600 > 4.5.1.r4533, BE6500 > 4.4.1.r4308, ER1 and ER2 > 4.5.1.r4518) as soon as JD Cloud publishes fixed firmware, monitoring https://www.jdcloud.com/cn/ for advisories. Until a patched build is confirmed, apply compensating controls: disable remote/WAN-side web management so the vulnerable interface is not reachable from the internet (side effect: administration only from the LAN); restrict access to the router management port to a trusted management VLAN or specific admin hosts via firewall ACLs (side effect: breaks remote admin and app-based management); and place these routers behind an upstream firewall if they are edge-facing. If the device is non-critical and internet-exposed, consider replacing it with a supported model, as consumer router firmware fixes can be slow.